We return a 502 when we can't get the keys for an incoming federation request

This issue has been migrated from [#5094](https://github.com/matrix-org/synapse/issues/5094).

---

When we first receive a request over federation from a new server, we attempt to make a connection back to that server to retrieve its signing keys.

If that outbound request fails, we return '502 Bad Gateway' to the original request. However, it's a failure to (correctly) authenticate, so we should instead we should return a 40x (probably a 401?).

Start by tracing the incoming federation request path and the outbound signing-key retrieval described in the issue. Reproduce or inspect the failure path, then verify that an inability to authenticate the remote server produces an appropriate 40x response instead of 502 Bad Gateway.

Written by the indexing model from the issue text.