Stabilise MAS integration

[sandhose]

This can be reviewed commit by commit

There are a few improvements over the experimental support:

• authorisation of Synapse <-> MAS requests is simplified, with a single shared secret, removing the need for provisioning a client on the MAS side
• the tests actually spawn a real server, allowing us to test the rust introspection layer
• we now check that the device advertised in introspection actually exist, making it so that when a user logs out, the tokens are immediately invalidated, even if the cache doesn't expire
• it doesn't rely on discovery anymore, rather on a static endpoint base. This means users don't have to override the introspection endpoint to avoid internet roundtrips
• it doesn't depend on authlib anymore, as we simplified a lot the calls done from Synapse to MAS

We still have to update the MAS documentation about the Synapse setup, but that can be done later.

[reivilibre]

thanks for the step-by-step commits!

[emilylange]

With experimental_features.msc3861 being deprecated in favor of matrix_authentication_service (highly appreciated btw) and scheduled for removal in v1.137.0, what's the plan for experimental_features.msc4108_enabled that still asserts for experimental_features.msc3861 being enabled?

synapse/synapse/config/experimental.py

Lines 538 to 544 in 7ed4f65

	if (
	self.msc4108_enabled or self.msc4108_delegation_endpoint is not None
	) and not self.msc3861.enabled:
	raise ConfigError(
	"MSC4108 requires MSC3861 to be enabled",
	("experimental", "msc4108_delegation_endpoint"),
	)

Edit: #18808