We shouldn't let people DoS us via /sync (SYN-660)

[matrixbot]

Submitted by @​matthew:matrix.org
If people are hammering us too rapidly on /sync without a timeout or with too small a timeout, presumably we should insert an implicit timeout to slow them down. c.f. the current DoS from 93.92.200.183

(Imported from https://matrix.org/jira/browse/SYN-660)

[richvdh]

we also shouldn't let them DoS us via initial /sync.

See also #6998.

[olmari]

This can be abused very easily with request that one does not care answer for, just fire away... sent PoC on security email. In order of seconds to make our quite beefy HS to OOM...