Element-web sends, and responds to, hopeless m.room_key_request messages

[richvdh]

The mitigations to CVE-2022-39249 and friends mean that we will never trust an m.forwarded_room_key message from another user's device. Accordingly, there is no point sending m.room_key_request messages to other users.

Nevertheless we still send such messages, and indeed respond to them. Not doing so would reduce the volume of to-device messages that need to be sent around and processed, and might also make debugging UTD errors easier because of the reduced noise.

[uhoreg]

Also, since cleartext sender_key and device_id are deprecated (MSC3700), we eventually won't know the sending device, so won't be able to send the room key request.

[richvdh]

It's also problematic that we send out m.room_key_requests as soon as we receive a UTD event.

In practice, to-device messages may be delayed for a number of reasons (such as #24680, matrix-org/synapse#15161, or just the server being a bit busy), and sending out room-key requests so eagerly ends up exacerbating the situation due to increasing the network traffic and #24681.