fix: Don't serve events over s2s that are rejected

src/api/server/event_auth.rs

@@ -26,6 +26,15 @@ pub(crate) async fn get_event_authorization_route(
 	.check()
 	.await?;
 
+	if services
+		.rooms
+		.pdu_metadata
+		.is_event_rejected(&body.event_id)
+		.await
+	{
+		return Err!(Request(NotFound("Event not found.")));
+	}
+
 	if !services
 		.rooms
 		.state_cache