Way back in 4.1.2.818 the following was added:

// New to VersionNumber = '4.1.2.818';
{TODO -cNew The keyword searches are now performed also against all MIME headers, allowing to search for example the Content-Type, charset, Content-Transfer-Encoding, Content-Disposition and filename}

Are keywords automatically scanned in all MIME headers or do we target them like a subject search?

I want to build something to block specific charset matches.  For example if I want to block Korean, I could look for charset="koi8-r" or would I need something like:

content-type:charset="koi8-r"

There's nothing special you need to do, SpamFilter will look thru that content as if it was part of the email's body. Do note however that in your example, some emails won't have that exact syntax. For example, in addition to: