Only disclose devicelists on a need to know basis

Nobody has claimed this yet.

**Suggestion**

Currently anyone can see anyone else's device list, posing an unnecessary privacy exposure.

Instead, we could limit the device list APIs such that only users who you share an E2EE room with can see them - so a user would have to explicitly accept a DM or join a private room before exposing their device details.

This would avoid the unpleasant surprise of being able to see random users' other devices in a public chatroom.

(This could be problematic for MSC3401, which uses to-device messaging for voip calls in non-e2ee rooms, but given users participating in the call explicitly advertise their devices via m.call.member events, it should work out okay.

Another thing that could break would be to-device based device verification. But if one is verifying within a DM (as you should, these days) it should be okay.)

Credit to https://twitter.com/gamingonlinux/status/1510239751286235138 for the idea (and further context).

Begin with the device list APIs and the proposed E2EE-room sharing condition, then review MSC3401 and to-device device verification as compatibility cases. Done means the specification defines who may see device lists while addressing the explicitly mentioned calling and verification flows.

Written by the indexing model from the issue text.