Users whose servers were unreachable will receive undecryptable messages due to failed OTK claim

* Alice tries to send a message in a room that includes Bob.
* Bob's server is offline; Alice's OTK claim therefore times out. Alice sends the message anyway without sharing the key with Bob.
* Later, Bob comes back on line. He receives the room message but not the keys.

Even if Alice subsequently sends another message using the same session, and tries again to share the session key with Bob, it is likely that she will share the megolm ratchet starting at that *second* message rather than the first one.

Bob will never be able to decrypt the message.

---

Tasks, with T-shirt sizes

Spec side:
* [ ] Update MSC4081; we need to add unstable prefixes (S)

Server side:
* [ ] Fix https://github.com/element-hq/synapse/issues/11374 (M)
* [ ] Extend `/keys/upload` impl and `e2e_fallback_keys_json` table to record "eager_share" flag (S). Remember to add to `synapse_port_db`.
* [ ] Trigger `m.device_list_update` when fallback keys are updated (S)
* [ ] Include details of fallback_keys in `m.device_list_update` EDU (L)
* [ ] When we receive fallback_keys in `m.device_list_update` EDU, stash them in `e2e_fallback_keys_json` (or do we need a separate table?) (L)
* [ ] Update `/keys/claim` implementation not to set `used` flag on `eager_share` keys, in both sqlite and postgres impls (S)
* [ ] Update `/keys/claim` implementation to fall back to the local store when the remote server is inoperative.

matrix-sdk-crypto:
* [ ] Keep old fallback keys around for longer (M).
* [ ] Ignore `device_unused_fallback_key_types` in `/sync`, and instead rotate keys when the current one is old, or has been used (M).
* [ ] Set `eager_share_fallback_keys` flag in `/keys/upload` request (S)

Testing:
* Write a complement-crypto test for this scenario (L)