Drop support for calling /_matrix/client/v3/rooms/{roomId}/invite without an id_access_token

[richvdh]

The 3pid-invite version of POST /_matrix/client/v3/rooms/{roomId}/invite (spec) has id_access_token as a required parameter.

We currently accept requests without an id_access_token, and then call /_matrix/identity/api/v1/lookup, which was removed from the spec over a year ago (matrix-org/matrix-spec-proposals#2713).

Instead, we should simply reject any requests that do not pass an id_access_token.

[richvdh]

We should also give sending 3pid invites via /createRoom the same treatment for the same reasons.

[richvdh]

Judging from the matrix.org access logs, it seems that both element-web (element-hq/element-web#22757) and element-ios (element-hq/element-ios#6385) currently make such requests, so we'll need to get this fixed there first.

[richvdh]

Using these endpoints without an id_access_token means that:

• we call /_matrix/identity/api/v1/lookup instead of /_matrix/identity/api/v2/lookup to look up the threepid
• we call /_matrix/identity/api/v1/store_invite instead of /_matrix/identity/api/v2/store_invite to store the invite
• we use /_matrix/identity/api/v1/pubkey/isvalid instead of /_matrix/identity/api/v2/pubkey/isvalid as the key validity url in the generated invite event.