Properly define byte vs string types in source and cache api boundaries

While doing the python3 conversion I realised that the data handlers never cared about encodings and now we've got a mix of ascii and utf8 encodings between sources and caches. I'd like to formally state what types go where and enforce it.

For example, is nssdb a utf8 compatible cache? Or does it have to be ascii only? I think OpenLDAP, Samba4, etc allow utf8?

Should the Updater deal in Python `str` types and convert to bytes or deal with bytes only and avoid any encoding at all?

Once decided on, can pytype annotations force us to get conforming code?