when both WITH_FOO and WITHOUT_FOO are set. Use this where
possible. Only disallow setting of MK_FOO on the command line. This
was preferable to inventing a new mechanism or fixing the undef bug
(bin/183762) which precludes users from turning off anything we turn
off for parts of the build with WITHOUT_FOO prior to this.