invalid auth required error causing synapse to fail to load remote avatars from certain instances

### Description

My instance fails to load remote avatars from users of certain instances (which IIRC use EMS): kde.org, fedora.im, gnome.org

The source issue seems to be an `invalid auth required` error, as grepped with `journalctl --user-unit synapse --follow --grep kde` whenever I click on a kde.org and try to load the avatar in any Matrix client. I also see this error whenever I click on a gnome.org or fedora.im user.

### Steps to reproduce

- Updated to latest Synapse
- Added mautrix-telegram (probably unrelated)
- Purged remote media cache

### Homeserver

mx.rabbitictranslator.com

### Synapse Version

1.135.0

### Installation Method

Docker (matrixdotorg/synapse)

### Database

Single PostgreSQL server, not ported, not restored from a backup

### Workers

Single process

### Platform

I expose my server via IPv6 on a Raspberry Pi4 running openSUSE MicroOS. It has firewalld running.

I run Synapse as a rootless podman quadlet container:

```
[Container]
Image=docker.io/matrixdotorg/synapse:latest
ContainerName=synapse
AutoUpdate=registry
LogDriver=journald

PublishPort=8008:8008
PublishPort=8448:8448

Volume=./data:/data:rw,z

UserNS=keep-id

Network=pinet.network

[Service]
Restart=on-success
ExecStartPre=sleep 10

[Install]
WantedBy=default.target
WantedBy=synapse-postgres.service

[Unit]
BindsTo=synapse-postgres.service
```

Which should be virtually the same as running `podman run --tty --interactive --name=synapse --volume=./data:/data:rw,z --userns=keep-id --network=systemd-pinet --publish=8008:8008 --publish=8448:8448 docker.io/matrixdotorg/synapse:latest`.

I have those PublishPorts because I was testing this issue.

My PostgreSQL server uses a bind mount with rw,z that stores my database data in an external ext4 SSD, if that matters.

I use Caddy for the reverse proxy server in the same container network, pretty standard:

```
mx.rabbitictranslator.com {
reverse_proxy /_matrix/* synapse:8008
reverse_proxy /_synapse/client/* synapse:8008

header /.well-known/matrix/* Content-Type application/json
header /.well-known/matrix/* Access-Control-Allow-Origin *
respond /.well-known/matrix/server `{"m.server": "mx.rabbitictranslator.com:443"}`
respond /.well-known/matrix/client `{"m.homeserver": {"base_url": "https://mx.rabbitictranslator.com"}}`
}
```

All my services run as rootless podman quadlets.

### Configuration

_No response_

### Relevant log output

```shell
synapse.http.federation.well_known_resolver - 278 - INFO - GET-422 - Fetching https://kde.org/.well-known/matrix/server
synapse.http.federation.well_known_resolver - 215 - INFO - GET-422 - Response from .well-known: {'m.server': 'kde.modular.im:443'}
synapse.http.matrixfederationclient - 772 - INFO - GET-422 - {GET-O-310} [kde.org] Got response headers: 400 Bad Request
synapse.http.matrixfederationclient - 862 - WARNING - GET-422 - {GET-O-310} [kde.org] Request failed: GET matrix-federation://kde.org/_matrix/federation/v1/media/download/ff8de0bc2018ff08267d4e903b793d5239337a79?timeout_ms=20000: HttpResponseException('400: Bad Request')
synapse.media.media_repository - 943 - WARNING - GET-422 - HTTP error fetching remote media kde.org/ff8de0bc2018ff08267d4e903b793d5239337a79: b'{"errcode":"M_FORBIDDEN","error":"invalid auth provided (required)","mr_errcode":"M_BAD_REQUEST"}'
synapse.http.server - 133 - INFO - GET-422 - SynapseError: 502 - Failed to fetch remote media
synapse.access.http.8008 - 508 - INFO - GET-422 - 10.89.0.29 - 8008 - {@herzenschein:mx.rabbitictranslator.com} Processed request: 1.419sec/0.001sec (0.017sec, 0.001sec) (0.001sec/0.004sec/1) 62B 502 "GET /_matrix/client/v1/media/thumbnail/kde.org/ff8de0bc2018ff08267d4e903b793d5239337a79?width=80&height=80&method=crop&allow_redirect=true HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/60.5 Safari/605.1.15" [0 dbevts]
```

### Anything else that would be useful to know?

This server is relatively new, only a year or so.

A year ago, when I was testing Conduit and Conduwuit I did not see this issue.

Even back when I used to host a different Synapse server on a VPS with public IPv4 I had a similar issue, but with any media from kde.org users, back during the authenticated_media transition. Other selfhosters also happened to have this issue.

I only found out about this loading issue recently after I ran a purge_media_cache. It probably used to work long ago, stopped working at some point, and I've been seeing cached remote avatars for a long time...