fix: Return M_UNKNOWN_DEVICE for unknown masqueraded appservice devices

When an appservice masqueraded as a device_id that does not exist for
the user, we returned 403 M_FORBIDDEN. The spec requires 400
M_UNKNOWN_DEVICE.

changelog.d/2451.bugfix.3.md

@@ -0,0 +1 @@
+Appservices masquerading as a device that does not exist now receive 400 `M_UNKNOWN_DEVICE` as required by the spec, instead of 403 `M_FORBIDDEN`.

src/api/router/auth.rs

@@ -379,10 +379,7 @@ async fn check_access_token(
 				.await
 				.is_err()
 			{
-				return Err!(Request(Forbidden(
-					"Device does not exist for user or appservice cannot masquerade as this \
-					 device."
-				)));
+				return Err!(Request(UnknownDevice("Device does not exist for this user.")));
 			}
 
 			Some(device_id.to_owned())