Support OIDC RISC events

This issue has been migrated from [#11514](https://github.com/matrix-org/synapse/issues/11514).

---

OIDC Back-Channel Logouts (#11326) is a step in the direction of properly syncing user sessions when something happens on the OIDC side. There are a lot of other cases where for example the account gets disabled or locked, and it is not reflected on Synapse's side.

There is a working group in the OpenID foundation called `RISC` (Risc Incident Sharing and Coordination) which tries to define a standard way to signal account security events (account locked, unlocked, removed, compromised) based on [RFC8417](https://www.rfc-editor.org/rfc/rfc8417.html): Security Event Token. This would allow us to react when the following events happen on the IdP side, according to [the spec draft](https://openid.net/specs/openid-risc-profile-specification-1_0-01.html):

- **Account Credential Change Required** signals that the account identified by the subject was required to change a credential. For example the user was required to go through a password change.
- **Account Purged** signals that the account identified by the subject has been permanently deleted.
- **Account Disabled** signals that the account identified by the subject has been disabled. The actual reason why the account was disabled might be specified with the nested reason attribute described below. The account may be enabled in the future.
- **Identifier Changed** signals that the identifier specified in the subject has changed.
- **Identifier Recycled** signals that the identifier specified in the subject was recycled and now it belongs to a new user.
- A **Credential Compromise** event signals that the identifier specified in the subject was found to be compromised.
- **Opt-In/Out** related events. Users must be able to opt-in or out of RISC events between the IdP and the app, hence those events.
- **Recovery Activated** signals that the account identified by the subject activated a recovery flow.
- **Recovery Information Changed** signals that the account identified by the subject has changed some of its recovery information. For example a recovery email address was added or removed.
- **Sessions Revoked** signals that all the sessions for the account identified by the subject have been revoked.

Not all events are relevant to Synapse, but I definitely find those interesting.

The good news for us is that security event token look a lot like logout tokens from the OIDC back-channel logouts (which was by the way intended by the OIDC folks), so a lot of the implementation is already done in the OIDC back-channel logout PR.
The bad news is that RISC is not widely adopted by OIDC providers. I know Google adopted it and brands this as [Cross-Account Protection](https://developers.google.com/identity/protocols/risc), but it is not supported by Keycloak, Auth0, etc.

Note that this will also be useful in the "OIDC-native" world.

_I originally posted this in https://github.com/matrix-org/synapse/issues/11500#issuecomment-986939209_

The issue names no source file or test; start by reviewing the OIDC Back-Channel Logouts implementation it references, then read RFC8417 and the RISC profile draft. Determine which listed security events are relevant to Synapse and what session or account state should be synchronized; done means the supported events are handled consistently and covered by appropriate tests.

Written by the indexing model from the issue text.