Current UIA grace period behaviour is probably not spec compliant

This issue has been migrated from [#15166](https://github.com/matrix-org/synapse/issues/15166).

---

### Description

The Client-Server API [spec](https://spec.matrix.org/v1.6/client-server-api/#user-interactive-api-in-the-rest-api) states:

> A request to an endpoint that uses User-Interactive Authentication never succeeds without auth. Homeservers may allow requests that don’t require auth by offering a stage with only the m.login.dummy auth type, but they must still give a 401 response to requests with no auth data.

However, if Synapse is configured with a grace period then the `auth` field of the request body is not mandated and instead the request goes straight ahead.

### Steps to reproduce

- sign in to matrix.org using something like Element Web
- get your access token and device ID from Settings
- within 15 mins of signing in do
- call `DELETE /devices/{deviceId}` with empty body
- you receive a `200 OK` response instead of a `401`

### Homeserver

matrix.org

### Synapse Version

1.78.0rc1 (b=matrix-org-hotfixes,6bb4db78ce)

### Installation Method

I don't know

### Database

PostgreSQL

### Workers

I don't know

### Platform

n/a

### Configuration

```yaml
ui_auth:
session_timeout: 15m
```

### Relevant log output

```shell
n/a
```

### Anything else that would be useful to know?

_No response_