Consider handling server ACLs through event auth rules rather than at the network level

Nobody has claimed this yet.

The topic of why server ACLs act at the network level, and not the event auth level [came up in discussion today](https://matrix.to/#/!NasysSDfxKxZBzJJoE:matrix.org/$ieSUyH3TSc_mrphwCBi6u0wi02mKvPG1-Xe8YWVuJ6c?via=matrix.org&via=libera.chat&via=envs.net) in #matrix-spec. Summarising the conversation, handling ACLs in event auth mean that:

* locking it to a room version, which has the side-effect of knowing that all compliant homeservers in the room should support server ACLs.
* This can prevent events from "leaking" out of servers that don't support server ACLs.
* Room participants will have a simple way to check if all homeservers in the room support server ACLs, instead of checking homeserver implementation projects and version numbers.
* This will boost support of server ACLs in homeserver implementations, as it will be necessary to participate in newer room versions.

The original [proposal for Server ACLs](https://docs.google.com/document/d/1aiuROf1__7ZFkJvDdAZQfBNxyzjYd-ijiRAcHJYqJCM/edit#) noted that doing so at the network level was done for the sake of time - however @richvdh commented that a DAG-level ban would be ineffective. I'd be interested to know why?

Start with the linked Matrix discussion and the original Server ACL proposal, then review the issue's summary of network-level versus event-auth handling. Investigate why a DAG-level ban was considered ineffective and determine whether the event-auth approach needs a concrete room-version design. Done means a documented decision or an accepted specification change.

Written by the indexing model from the issue text.