Do not check for internal account lock for MSC3861 delegated auth

This issue has been migrated from [#16215](https://github.com/matrix-org/synapse/pull/16215).

---

Turns out #15870 broke the admin token for MSC3861, because MAS is doing the request with a fake user (and it's not synapse's responsibility to know if an account is locked or not)

Start by reviewing the MSC3861 delegated-authentication flow and the change from #15870, with attention to how MAS requests use a fake user. Trace where the internal account-lock check affects the admin token, then verify that delegated requests no longer fail because of that check.

Written by the indexing model from the issue text.