Return REPLACEMENT for UTF-8 empty malformation

Return REPLACEMENT for UTF-8 empty malformation

The previous commit no longer allows this so-called malformation under
DEBUGGING builds, except if code explicitly changes to request it (or
already explicitly does, but there are no instances of this in CPAN).

If it is explicitly allowed, prior to this commit it returned NUL.  If
it wasn't allowed, it returned 0.  Most code won't treat these as
different.  When returning NUL, it basically is making nothing into
something, which might be exploitable some way by an attacker.  The
Unicode accepted way of dealing with malformations is to replace them
with the REPLACEMENT CHARACTER, and so this commit changes things to
conform to this.