Validation for events/rooms in fed requests

[richvdh]

When we get a federation request which refers to an event id, make sure
that said event is in the room the caller claims it is in.

[richvdh]

@matrixbot retest this please

[richvdh]

@matrixbot retest this please

[richvdh]

[the tests are being Difficult because sytest includes a bunch of tests for things like lazy-loading and a new /register API which were not present in 0.33.0

[richvdh]

Some background on this vulnerability:

A number of federation endpoints, which take both a room id and an event id, do not correctly validate that the two match. They apply authentication checks based on the room id, but return results based on the event id. It is therefore possible, given an event id, for servers to get details of events which they should not have access to.

The following endpoints are affected:

GET /federation/v1/backfill/{roomId}/?v={eventId}
GET /federation/v1/state/{roomId}/?event_id={eventId}
GET /federation/v1/state_ids/{roomId}/?event_id={eventId}
POST /federation/v1/query_auth/{roomId}/{eventId} with body {"auth_chain": []}