Better handling of messages with withheld keys

[richvdh]

If we get a message that we can't decrypt, we check if we have previously received an m.room_key.withheld message about that session, and if so, show a different error message.

Two problems:

• (untested) AFAICT, if the m.room_key.withheld arrives after the room message, we don't go back and update the error message.
• There is a separate Posthog error code (RoomKeysWithheldForUnverifiedDevice) for events with a withheld code of m.unverified, allowing us to distinguish these "expected UTDs" from other UTDs. We don't use it currently.

[richvdh]

Closing in favour of element-hq/element-meta#2588 and element-hq/element-meta#2589