The user experience for pasting to the bitcoin address input field in a web form varies widely across Bitcoin's growing presence on exchanges, merchant sites,  blogs, etc.

Is it appropriate to massage the value that was input?  e.g., to strip out leading blank space character, or a trailing linefeed, etc?

Or are there any other tips regarding the UX for this field?

Trimming invalid characters is a good idea. The chance that you make a valid address from nothing is nearly 0 -- if you get a valid address, the user pasted one.

I've seen many sites assume that Bitcoin addresses must be 33 or 34 characters long, but they can actually be 25-43 characters in length.

All sites should verify address checksums. I don't like the idea of asking Bitcoin over RPC for every address, though: there's code for checking yourself in several languages.

26 characters:
11111111111111111111BZbvjr

I did wrongly remember the upper limit, though. It is 34 characters. I must have flipped the digits in my head.