Key backup restore API lacks sensible pagination

The existing key backup restore API offers three ways to fetch backups:

* You can get [the full backup at once](https://spec.matrix.org/v1.8/client-server-api/#get_matrixclientv3room_keyskeys), which is slow and impractical for huge backups (several 10s of minutes for big backups).
* It allows queries [per session](https://spec.matrix.org/v1.8/client-server-api/#get_matrixclientv3room_keyskeysroomidsessionid) and in this case will require a lot of requests to get history.
* Finally it’s possible to get all [keys for a given room](https://spec.matrix.org/v1.8/client-server-api/#get_matrixclientv3room_keyskeysroomidsessionid) but with no particular order. This can still take a long time and will retrieve old keys for history that is not even downloaded on the client.

A better API should provide access to keys for a given room with pagination, allowing a new login to decrypt recent history very quickly. This is particularly useful when using next gen clients that will do a lot of smart spidering to just bottleneck on the download of keys.

Start by reading the linked Matrix client-server API sections for full, per-session, and per-room key-backup restore requests. Compare their retrieval and ordering behavior, then define the pagination requirements and verify that the proposed API can prioritize recent room history; the issue provides no repository files or tests to run.

Written by the indexing model from the issue text.