Strip (EXIF) metadata of avatars

Currently, when viewing the avatar of a user, one can download the originally uploaded image file (also e.g. via [`GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`](https://spec.matrix.org/v1.15/client-server-api/#get_matrixclientv1mediadownloadservernamemediaid)). This file includes all metadata that was included in the uploaded image, for example locations, times, and camera models.

This is surprising behaviour as many messengers like Telegram, WhatsApp, and Signal strip metadata on upload of media. Many users thus expect this from other messengers as well.

The same is true for other media, like images added to a chat in a room. We understand that there is nothing Synapse can do in this case (assuming encryption gets used). There it is the responsibility of the client to do the stripping (which not all do, see e.g. https://github.com/element-hq/element-web/issues/4426 for element-web).

Notably, the smaller versions of avatars, downloadable e.g. via [`GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`](https://spec.matrix.org/v1.15/client-server-api/#get_matrixclientv1mediathumbnailservernamemediaid) are not only smaller in pixel dimensions but also stripped of all original metadata.

We are specifically talking about the download of full-size avatar images, where Synapse should be able, on a technical level, to strip all metadata. The [specification](https://spec.matrix.org/v1.15/client-server-api/) does not seem to contain a provision on whether to strip (EXIF) metadata when returning media, at least we couldn't find anything. Specifically, it does not explicitly allow stripping of metadata when generating thumbnails which would be required, in our understanding, in case it would require them to be kept on non-thumbnail download routes.

We are aware of https://github.com/matrix-org/matrix-spec/issues/113 and would propose to use the area of unclear specification and, potentially behind an off-by-default feature flag, simply remove all metadata from avatars on download.

Start with the Matrix media download endpoint and compare its full-size avatar handling with the thumbnail endpoint, which already strips metadata. Clarify whether the change applies only to avatars and whether an off-by-default feature flag is required; done means full-size avatar downloads no longer expose the uploaded image metadata.

Written by the indexing model from the issue text.