Consider the user_id alongside the access_token when no-opping /send

This issue has been migrated from [#2937](https://github.com/matrix-org/synapse/issues/2937).

---

### Description

This is more of an issue for testing appservices, and likely doesn't affect real appservices as the libraries already handle incrementing the transaction.

Appservices can use the `?user_id` query parameter to impersonate another user in their namespace. However, synapse doesn't consider this when checking to see if an event has already been sent. The easiest way to see this in action is to use the following two curl commands (assuming the appservice is registered, etc):

```bash
# Send 'Hello world' as @_test_one:domain.com with transaction ID `__TXNID__`
curl -X PUT -H "Content-Type: application/json" --data-binary '{"msgtype":"m.text","body":"Hello world"}' 'https://homeserver.org/_matrix/client/r0/rooms/!myroom:domain.com/send/m.room.message/__TXNID__?access_token=YourAppserviceAccessToken&user_id=@_test_one:domain.com

# Send 'Hello world' as @_test_two:domain.com with transaction ID `__TXNID__`
# The only thing that has changed is the user ID
curl -X PUT -H "Content-Type: application/json" --data-binary '{"msgtype":"m.text","body":"Hello world"}' 'https://homeserver.org/_matrix/client/r0/rooms/!myroom:domain.com/send/m.room.message/__TXNID__?access_token=YourAppserviceAccessToken&user_id=@_test_two:domain.com
```

Expected: two 'hello world' messages
Actual: only the first sender gets through, the second is no-oped

Tested with synapse 0.26.0