Handle `$pull` update validators separately from `$set`

There's a lot of quirks like `$in` (#4440) and array vs single object (#6889) that make update validators pretty brittle with `$pull`. We should separate this out.

Start by tracing how Mongoose handles update validators for `$pull` and `$set`. Review the quirks described in issues #4440 and #6889, then define the separate `$pull` behavior and verify that the existing validator cases no longer share the brittle handling.

Written by the indexing model from the issue text.