User can mark message read to an event in a room he's not member of

### Description

there is no check here to validate if the user owns the `event_id` before marking it as read.

https://github.com/element-hq/synapse/blob/081f6ad50fa0ea87c348778e8be40517da25c698/synapse/rest/client/receipts.py#L62-L123

### Steps to reproduce

- list the steps

Use the curl
```sh
curl --location 'http://localhost:8008/_matrix/client/v3/rooms//receipt/m.read/' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer ********' \
--data '{
}'
```

- that reproduce the bug

when I execute this sql statement on db
```sql
select * from receipts_graph
```
I can see a record of the newly marked event.

### Homeserver

localhost

### Synapse Version

latest

### Installation Method

Other (please mention below)

### Database

postgres

### Workers

Single process

### Platform

macos

### Configuration

_No response_

### Relevant log output

```shell
NA
```

### Anything else that would be useful to know?

I don't think it's big issue, but it can flood the db with unrelated content, like why should I keep the data of events or rooms the user hasn't joined