Handle events which fail auth on their `auth_events` differently from those that fail on the resolved state

[richvdh]

Following up a comment at #10956 (comment):

We can now mark an event as rejected in either of two cases:

• the event does not pass the auth rules based on its auth_events
• the event does not pass the auth rules based on the resolved state at that point on the DAG.

As is pointed out in that comment thread, we should probably consider these two cases differently.

[richvdh]

It's worth noting that the spec says nothing about treating these differently:

• Passes authorization rules based on the event's auth events, otherwise it is rejected.
• Passes authorization rules based on the state at the event, otherwise it is rejected.

... so improving this will also involve updating the spec.