perry & crenn - Thank you very much for checking this. You're very helpful. That's saved me futzing around for a day or two.
You have saved tomorrow (that almost sounds poetic or profound, or a James Bond sequel :-)
The RM0008 manual about GPIO pins is a bit hard going, but clamping to Vdd + diode drop is what I read from Figure 14 on page 147. The value of Vdd+0.3V is defined in the STM32F103x8/xB datasheet (13587.pdf at st.com) in "5.2 Absolute maximum ratings" Table 6. Elsewhere I think a datasheet or manual says 4 or 5mA maximum current for the protection diode, so I was planning on 1K current limiting.
I am using 5V tolerant pins.
I don't know which servos will end up being used, so I chose to use 5V tolerant pins. It seemed safer to pull-up to 5V rather than hope a servo works reliably at 3.3V.
Thanks again.