The Application Service API specifies that missing or invalid `hs_token`s should result in a 403, but some endpoints spec 401

Nobody has claimed this yet.

The Application Service API spec has an [Authorization section](https://spec.matrix.org/v1.6/application-service-api/#authorization) which states:

> Homeservers MUST include an `Authorization` header, containing the `hs_token`
> from the application service's registration, when making requests to the
> application service. Application services MUST verify that the provided
> `Bearer` token matches their known `hs_token`, failing the request with
> an `M_FORBIDDEN` error if it does not match.

However the following endpoints spec a `401` error response in the case of "The homeserver has not supplied credentials to the application service".

* [`GET /_matrix/app/v1/users/{userId}`](https://spec.matrix.org/v1.6/application-service-api/#get_matrixappv1usersuserid)
* [`GET /_matrix/app/v1/rooms/{roomAlias}`](https://spec.matrix.org/v1.6/application-service-api/#get_matrixappv1roomsroomalias)

I think we should remove the `401` codes specified by these two endpoints. We can specify the common error cases (which probably should include `401`) elsewhere in the doc.

Related: https://github.com/matrix-org/matrix-spec/issues/1528

Start with the Application Service API Authorization section and the response definitions for GET /_matrix/app/v1/users/{userId} and GET /_matrix/app/v1/rooms/{roomAlias}. Confirm how each endpoint documents missing credentials, remove the inconsistent 401 responses, and verify that both endpoints align with the stated M_FORBIDDEN behavior.

Written by the indexing model from the issue text.