In ARP spoofing, is it two MACs mapping to one IP address OR two IPs mapping to one MAC address?
Neither. Yup, let that sink in for a second. ARP spoofing may be involved in both the situations you are describing, however the situations you are describing may not include ARP spoofing.
So what is ARP spoofing? ARP spoofing is simply the name for when a network device/interface "spoofs" or imitates ARP messages for an IP address that the device is not actually using.
two MACs mapping to one IP address
This may simply be a misconfiguration. Both devices could have the same IP address configured and as such no ARP spoofing is taking place. This would simply be an IP conflict, which does create issues but can't be called ARP spoofing.
However, many ARP attacks using spoofing will produce IP conflicts as the spoofing device will often spoof the IP addresses of other actual devices.
two IPs mapping to one MAC address
This is common in many networks as a single interface can have multiple IP addresses. With IPv6 in use, a device should have multiple addresses (at least a global and a link local). Dual stack devices should have both an IPv4 address and multiple IPv6 addresses.
On top of that, there are many reasons/devices where more than one IP address are assigned to a single interface. Just as one example among many, load balancers are typically configured to provide services for a number of different IP addresses on a single interface. There are many more examples, but in all these cases, no ARP spoofing it taking place as the devices are using each IP address.
Yet again, a device performing some types of ARP attacks will often be spoofing the ARP messages for multiple IP addresses.
So why not just say that ARP spoofing is when ARP is used in a negative way, such as some types of ARP attacks?
Throwing this in for completeness, even though you didn't ask. The most common context where ARP spoofing is discussed is associated with different types of attacks on networks.
However, this doesn't mean that ARP spoofing is always a negative. An example of a legitimate use of ARP spoofing would be "proxy ARP." One way this can be used is in configurations where direct client-to-client communications is prohibited and must pass through some "central" device where things like security rules may be enforced.