to-device messages that have been sent to appservices aren't deleted

This issue has been migrated from [#11423](https://github.com/matrix-org/synapse/issues/11423).

---

Split out of https://github.com/matrix-org/synapse/issues/10653, and deliberately removed from the scope of https://github.com/matrix-org/synapse/pull/11215.

Application services can receive to-device messages intended for the devices of users that reside within their namespace. Note that both local and remote users can be included here.

From conversation in https://github.com/matrix-org/synapse/issues/10653, the plan is to only delete delivered to-device messages if the responsible namespace is marked as exclusive. If so, it is assumed that no other application service nor user device will be also trying to receive these to-device messages. And thus they can be safely deleted.

Ideally we would add this after https://github.com/matrix-org/synapse/issues/11150, as it's a bit terrifying to delete messages without knowing whether they've been successfully delivered or not.

Start by reviewing the related issues #10653 and #11150 and the deliberately excluded pull request #11215 to understand the delivery and deletion constraints. The issue names no source file or test, so locate the application-service handling for to-device messages first; done means safely deleting delivered messages only for exclusive namespaces.

Written by the indexing model from the issue text.