Auth rules for power levels events doesn't validate userid domain

### Description

For all room versions, the auth rules in the spec state something like this for `m.room.power_levels` events ([v1]):

> If the users property in content is not an object with keys that are valid user IDs with values that are integers (or a string that is an integer), reject.

I observed a synapse server accept a power levels event with an entry in the `users` object that looks like `"@someuser:*" 49`. This is not a valid userid because `*` is not a valid server name. My grapevine server (correctly) rejected this, split-braining the room. Ruma seems to implement the check correctly, and so I expect all ruma-based servers would also reject an event like this.

[v1]: https://spec.matrix.org/v1.14/rooms/v1/#authorization-rules

### Steps to reproduce

- set up a new room
- send a power levels event with the keypair `"@somebody:*": 0` in the event content `"users"` object
- observe that synapse accepts it

### Homeserver

calitabby.net

### Synapse Version

1.127.1

### Installation Method

I don't know

### Database

Don't know, it's not my server

### Workers

I don't know

### Platform

Don't know, it's not my server

### Configuration

_No response_

### Relevant log output

```shell
None, it's not my server
```

### Anything else that would be useful to know?

Pretty sure the problem is that synapse is trying to validate the user ids in a power levels event [here](https://github.com/element-hq/synapse/blob/0e3c0aeee833e52121b3167de486dff34018ab27/synapse/event_auth.py#L889), but is missing a `is_valid` call. I would actually test this and submit a patch myself, if it weren't for the synapse CLA.