What are the requirements for a ScriptPubKey to be valid? Can they have arbitrary scripts, as long as they are under a certain length?
In theory they can have any arbitrary script. In practice, only a handful of scripts are considered standard and will be relayed on the network: pay to pubkey, pay to pubkey hash, null data (op_return), pay to script hash and raw multisig.