`/sync` returns state events from before join in `timeline` instead of `state`

This issue has been migrated from [#9923](https://github.com/matrix-org/synapse/issues/9923).

---

### Description

When a user joins a room with history visibility set to `join` or `invite`, they may find recent state events pertaining to the current state of the room included in the timeline that, according to the history visibility spec, should be hidden.

I see that this behavior was introduced in #2451 as a workaround for matrix-org/matrix-ios-sdk#341 (and is in fact [being tested for](https://github.com/matrix-org/sytest/issues/385)), however it is contrary to the spec as far as I can tell.

It is also of practical concern. For example, a user joining a recently created room with limited history visibility will [see all of the state events from the room's creation](https://github.com/vector-im/element-web/issues/16074), leading them to falsely believe that there must have been no messages sent between the room's creation and when they joined. For this purpose, it would also be nice if the `m.room.create` event would be hidden as well (as e.g. Dendrite does), however I'm not entirely sure that that's the correct thing to do (since history visibility is `shared` for the split second of the room's creation).

Optimally, there would be a way to solve matrix-org/matrix-ios-sdk#341 while also applying history visibility rules correctly.

### Steps to reproduce

- Create a room with history visibility set to `invite` or `join`
- Possibly send some messages
- Join the room as a different user

Some state events (name, topic, etc.) that come after the history visibility state event but before the second user was invited/joined will nevertheless be visible to them in the timeline.

### Version information

- **Homeserver**: townsendandsmith.ml
- **Version**: 1.32.2
- **Install method**: NixOS module
- **Platform**: NixOS unstable