Insufficient type check of `creation_content` field on /_matrix/client/v3/createRoom

This issue has been migrated from [#13664](https://github.com/matrix-org/synapse/issues/13664).

---

### Description

This initially a reported as NVT#1536835 and cleared to be published.

The `/_matrix/client/v3/createRoom` seems to not do any type check on the fields of its body.

This can lead to an internal server error when it tries to add the room version. (see log below).

It does not disrupt the operation of synapse or has an attack vector. This simply seems to be missing input validation.

### Steps to reproduce

To reproduce you send a request to `/_matrix/client/v3/createRoom` with `{"creation_content":"{}"}` as a body.

The json object being a string is intentional here.

### Homeserver

A non public/federating testing server

### Synapse Version

{"server_version":"1.65.0","python_version":"3.9.13"}

### Installation Method

Docker (matrixdotorg/synapse)

### Platform

Running in a kubernetes cluster.

### Relevant log output

```shell
2022-08-12 13:20:23,146 - synapse.http.server - 183 - ERROR - POST-45489- Failed handle request via 'RoomCreateRestServlet':
Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/twisted/internet/defer.py", line 1660, in _inlineCallbacks
result = current_context.run(gen.send, result)
StopIteration

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 366, in _async_render_wrapper
callback_return = await self._async_render(request)
File "/usr/local/lib/python3.9/site-packages/synapse/http/server.py", line 572, in _async_render
callback_return = await raw_callback_return
File "/usr/local/lib/python3.9/site-packages/synapse/rest/client/room.py", line 91, in on_POST
info, _ = await self._room_creation_handler.create_room(
File "/usr/local/lib/python3.9/site-packages/synapse/handlers/room.py", line 890, in create_room
creation_content["room_version"] = room_version.identifier
TypeError: 'str' object does not support item assignment
```

### Anything else that would be useful to know?

_No response_