Forbid repeated upgrade of the same room

As of this writing, the spec allows upgrading a room that already has a tombstone event. I don't think there was a provision to use the upgrade mechanism to fork rooms; so let's just disallow upgrading a room if it already has `m.room.tombstone` in its state.

Locate the Matrix room-upgrade mechanism and the handling of m.room.tombstone in the specification. Confirm how an already-tombstoned room can currently be upgraded; done means the normative specification explicitly disallows upgrading such a room.

Written by the indexing model from the issue text.