Both. Hamid.
The ARP request is a broadcast, so the Destination MAC will be FFFF.FFFF.FFFF. Of course, you aren't asking about this, but I'm listing it here for clarity. You are asking about the Target MAC field inside the ARP Payload.
The ARP Request is meant to find the unknown L2 address from from a known L3 address. As such, the Target IP address field is populated with the L3 address we are trying to resolve for... but the Target MAC field can not be populated, as the whole purpose of the payload is to discover the target's MAC address.
As such, the RFC does not specify what the Target MAC should be, just that it doesn't matter what it is:
[Sender of ARP Request] does not set ar$tha to anything in particular, because it is this value that it is trying to determine. It could set ar$tha to the broadcast address for the hardware (all ones in the case of the 10Mbit Ethernet)
ar$tha = ARP payload, Target Hardware Address -- aka, the official name for the field you are asking about
The RFC suggests to use the broadcast address (all F's), but does not designate that as a requirement. So implementations are free to do what they will. Most that I have come across will use all F's, or all 0's, as you have found.