Identity Service API: No way to tell whether to prompt the user for an authentication token

Nobody has claimed this yet.

In the Client-Server API, when a client requests a 3pid authentication token (via any of the six `/.../requestToken` endpoints), the client can tell whether it should prompt the user to enter a token, or whether this will happen out-of-band, via the presence or absence of a `submit_url` endpoint.

See for example [`/_matrix/client/r0/account/3pid/email/requestToken`](https://matrix.org/docs/spec/client_server/r0.5.0#post-matrix-client-r0-account-3pid-email-requesttoken): "If this field is not present, the client can assume that verification will happen without the client's involvement provided the homeserver advertises this specification version in the /versions response (ie: r0.5.0)." (`submit_url` was added in [MSC2078](https://github.com/matrix-org/matrix-doc/blob/master/proposals/2078-homeserver-password-resets.md)).

However, there is no way for clients of the IS API to know which flow to expect. Currently, the best bet is to hardcode different behaviour based on whether the 3pid is an email or a msisdn, and assume that verification will happen out-of-band for an email and to require a token for msisdn. However, the spec doesn't say that this is a safe assumption, and it makes the IS API asymmetric with the CS API.

I think we should add a `submit_url` parameter to the `/_matrix/identity/api/v1/validate/*/requestToken` response.

Start with the Identity Service API definitions for the six /_matrix/identity/api/v1/validate/*/requestToken endpoints and compare their responses with the Client-Server API requestToken responses. Document the submit_url behavior and update the relevant specification text so clients can determine whether to prompt for a token. Done means the IS API behavior is explicit and consistent with the CS API.

Written by the indexing model from the issue text.