MSC4446: Allow moving the fully read marker to older events

Tracking issue for [MSC4446](https://github.com/matrix-org/matrix-spec-proposals/pull/4446): Proposal for allowing the fully read marker to be moved from newer to older events.

# Context

Historically, synapse would prevent read markers from being moved backwards. However this has not been explicitly required by the spec.

There's use cases for either behavior:
- A client that advances the read marker automatically while the user scrolls and reads messages typically appreciates a server-side sanity check, such that stale clients do not move the marker towards older events by accident.
- A client that exposes manual read marker control to the user may want to allow users to move it backwards explicitly, e.g. the user may long-press a message and decide to manually mark it as unread. Then this explicit action justifies bypassing the check and allow moving backwards as well.

Thus MSC4446 adds a `allow_backward` parameter (`com.beeper.allow_backward` while unstable) for clients to configure which behavior they prefer, when calling either of the client-server API endpoints that allow moving the read marker.

# Current design in synapse

Once https://github.com/element-hq/synapse/pull/19663 is merged, MSC support can be configured using

```yaml
experimental_features:
msc4446_enabled: True
```

When the flag is off, `allow_backward` is ignored from the endpoints, and synapse keeps enforcing that read markers may only be moved forward.
When the flag is on, `allow_backward` is respected as specified in the MSC.

# When to remove

- Immediately upon MSC rejection.
- When the MSC is accepted and merged into a future spec version, and synapse is ready to advertize support for the respective spec version via the `/_matrix/client/versions` endpoints, such that clients can still figure out that this feature is available.

Start by reviewing the client-server API endpoints that move the fully read marker and the experimental_features configuration described in the issue, including the MSC4446 flag and allow_backward parameter. Check how support is exposed through the /_matrix/client/versions endpoints. Done means the flag gates the parameter as described, backward movement is supported when enabled, and the removal conditions remain clear.

Written by the indexing model from the issue text.