Allocating a tombstone is currently done with the same function, __wt_update_alloc, that allocates update structures holding values. That means it is possible for callers to request a WT_UPDATE_TOMBSTONE but also pass in a non-NULL value. Indeed, that led to bugs and was fixed in WT-5745.

Rather than fixing things up inside __wt_update_alloc, implement a better approach that means it is impossible for calling code to make this mistake.