Handle events which fail auth on their `auth_events` differently from those that fail on the resolved state

This issue has been migrated from [#11018](https://github.com/matrix-org/synapse/issues/11018).

---

Following up a comment at https://github.com/matrix-org/synapse/pull/10956#issuecomment-937620313:

We can now mark an event as rejected in either of two cases:
* the event does not pass the auth rules based on its `auth_events`
* the event does not pass the auth rules based on the resolved state at that point on the DAG.

As is pointed out in that comment thread, we should probably consider these two cases differently.