Assign room creators / owners via the GraphQL API

Right now, nothing to do with room creation / ownership is implemented except for:
- rooms created by account tokens have their `created_by_account_id` set to that account.
- rooms created by app tokens return their `creator_assignment_token` in the json response. (This is obviously bad UX)

Creating rooms on behalf of specific users and/or assigning owners to rooms programmatically was one of the requests we got most frequently, so I intended to implement this (or help someone implement this) as a fast-followup once we got something deployed to production. We should do this.

App tokens should be allowed to assign creator and hub_role_memberships freely.
Account tokens should be allowed to assign hub_role_memberships.

Details on permissions are up for debate / design discussions.

The issue names no files, tests, or entry points. Start by reviewing the GraphQL room-creation API and the existing account-token and app-token behavior, then clarify the permission design for creator and hub_role_membership assignment. Done means the agreed token permissions and ownership assignment behavior are implemented and covered by relevant tests.

Written by the indexing model from the issue text.