The Megolm-related `forwarding_curve25519_key_chain` field is not very useful

**Link to problem area**:
- https://spec.matrix.org/v1.2/client-server-api/#mforwarded_room_key
- https://spec.matrix.org/v1.2/client-server-api/#backup-algorithm-mmegolm_backupv1curve25519-aes-sha2
- https://spec.matrix.org/v1.2/client-server-api/#key-export-format

**Issue**
Since modifications to `forwarding_curve25519_key_chain` are not cryptographically authenticated at each forwarding step, each forwarding participant may set the list to anything they like. This makes relying on the list insecure, but this fact is not clearly spelled out in the spec.

One context where it is safe to rely on, and where it might be useful, is when one cross-verified device of some user U forwards a Megolm session to another cross-verified device of the same user U. In this instance, the receiving device can rely on the field not to be illegitimately tampered with, potentially giving the field some use in this limited scenario. It's unclear whether this is enough to justify the field's existence.

In any case, we should spell out clearly that the field is unreliable except in certain explicitly enumerated scenarios. If the field is not found useful, we should consider deprecating it.

Read the three linked Matrix specification sections and compare how forwarding_curve25519_key_chain is described in each context. Determine which explicitly enumerated scenarios, if any, make the field trustworthy, then update the specification to state its limitations or document the deprecation question. Done means the field's security properties and intended use are unambiguous.

Written by the indexing model from the issue text.