API to allow access to account data for bridges

(This is more of a note to remind me to write up a doc, which will be soon. This is like a pre proposal)

In a nutshell, this API allows bridges to fetch configs from the user's homeserver rather than storing it locally in a database.

The idea behind this would be to allow read access to settings so that bridges could pull things like nicknames or stored passwords without having to store the information on the bridge where it may get lost, and requires the bridge developer to be more careful about what data they store.

Advantages of this include:

• Configuration is in control of the user, rather than the bridge.
• Configuration can be set, even if the bridge is offline.
• Configuration can be seen by multiple bridges where needed.
• Richer UIs are easier to write if modifying the local user's settings, rather than using a room or custom http api to talk to the bridge.

Disadvantages:

• If done wrong, this could add a vulnerability to sniff for user settings over federation.

The mechanism would work so that the AS user could request a certain key(s) from a user's account data and from then on a token would be generated which would give them access to request that dataset.

Since over federation, it is not easy to validate what a bridge looks like, let alone trustworthiness it would be desirable for client's to make a big thing of the request and show a warning.

I am unsure if there is yet a need for writable access, but this would probably be served as a room event that could prompt to store some data on the bridges behalf.

No file, test, or entry point is named. Start with the pre-proposal in this issue and clarify the requirements for bridge access to account data, token generation, federation security, and client warnings; done would be a decided and documented protocol proposal.