Configuration option to block DMs to appservice users until app/v1/users responds

This issue has been migrated from [#8710](https://github.com/matrix-org/synapse/issues/8710).

---

As a configuration option, I'd like to be able to tell my homeserver not to set up a DM with a user until the user has been created as a result of a call to `GET /_matrix/apps/v1/users`. This is because we would like to ensure that the user has created dehydrated devices that can handle encrypted messages before the DM is created and the inviter starts trying to talk to the user.

We already block sending members events to appservices until /users responds:https://github.com/matrix-org/synapse/blob/243d427fbcb24c78c2df143767cd4636844fc82e/synapse/handlers/appservice.py#L118

but I'd like to move this further up the stack to the point where the room is first created.

This shouldn't involve a spec change, and would likely only block for rooms where `is_direct` is `True`.

CC @bwindels @benparsons