A good solution might be to support a custom-specific character decoder,
that is called by libmicrohttpd instead of its internal
MHD_http_unescape(). This custom-specific decoder should be provided as a
call-back method by the user. If it is not defined, the internal
MHD_http_unescape() will be used.
The decoder should get a pointer to the input butter, and might return a
new pointer to the output buffer. This would be useful if the decoded
characters in the output buffer need more memory space than what is
available in the input buffer.
I think your argument for a custom decoder makes sense; however, I'm not sure
about allowing the custom decoder to return a new pointer. That would require
it to do memory allocation (at least as an option, and if it is optional the
interface will be even messier), and then we'd have to handle failures of that
(yuck).
This is especially critical given that your points do not seem to justify any
need for an unescape function to return a string that is longer than the
original input. If there is such a case, please describe it.