Media authentication & event linking (MSC3916, MSC3911)

[turt2live]

MSCs:

• MSC3916: Authentication for media matrix-org/matrix-spec-proposals#3916
• MSC3911: Linking media to events matrix-org/matrix-spec-proposals#3911

Fixes #421
Closes #103
Closes #266

TODO:

• MSC3916 - Split endpoints into Client-Server and Federation APIs
• MSC3916 - X-Matrix authentication on Federation APIs
• MSC3916 - Access token authentication on Client-Server APIs
• MSC3916 - multipart/mixed Content-Type on new /download and /thumbnail endpoints
• MSC3916 - Use new endpoints to download media
• MSC3911 - Flag uploaded/created media as restricted
• MSC3911 - Refuse download if restricted media checks fail
• MSC3911 - Link media to events on send (refuse duplicate binds)
• MSC3911 - Link media to profiles on update (maybe using MSC4069; refuse duplicate binds)
• MSC3911 - Delete/quarantine media when event is redacted
• MSC3911 - Delete/quarantine media when profile is updated away from event
• MSC3911 - Add media copy API
• MSC3911 - Delete unused restricted media after some (configurable?) time

MSC3916 implementation (with code commented out to bypass X-Matrix auth for curl 😇):

travp@DESKTOP-S0KMB7S MINGW64 ~
$ curl -s -X POST -H "Authorization: Bearer ${token}" -H "Content-Type: text/plain" --data 'Hello, world. This text needs to be longer so here are more characters.' http://localhost:8001/_matrix/media/v3/upload?filename=test.txt
{"content_uri":"mxc://localhost/cc1ad9bf8cc37be5c5369b739fc00233eaa9d8fb1700741659764981760"}


travp@DESKTOP-S0KMB7S MINGW64 ~
$ curl -s -X GET http://localhost:8001/_matrix/federation/unstable/org.matrix.msc3916/media/download/localhost/cc1ad9bf8cc37be5c5369b739fc00233eaa9d8fb1700741659764981760
--b82a7ae9c7f41bc9e8019a6b751b46fa50e407a9e8d05bba3099fb4cb91e
Content-Type: application/json

{}
--b82a7ae9c7f41bc9e8019a6b751b46fa50e407a9e8d05bba3099fb4cb91e
Content-Disposition: attachment; filename=test.txt
Content-Type: text/plain

Hello, world. This text needs to be longer so here are more characters.
--b82a7ae9c7f41bc9e8019a6b751b46fa50e407a9e8d05bba3099fb4cb91e--