Can the coinbase transaction be used to spend an UTXO? I know the coinbase transaction's input is usually just has a dummy scriptSig, but what if a miner used it to spend an UTXO? Would it be verified as an actual spend, or would the block be rejected?
It would be rejected.  The coinbase input must use a very specific previous outpoint: 0x0000000000000000000000000000000000000000000000000000000000000000ffffffff. This prevents it from referring to an actual previous outpoint.