`/sync` incorrectly calculates state changes for non-gappy syncs with lazy-loading

[richvdh]

Consider the following DAG:

             E1
           ↗    ↖
          |      S2
          |
        --|---
          |
          E3

• Lazy-loading client does an initial /sync, which returns state excluding S2 for the reasons explained in /sync and /members do not return "current state" #16940.
• Lazy-loading client now decides to load the full membership list in the room. This still excludes S2 due to /sync and /members do not return "current state" #16940.
• Client now assumes that it has a full membership list, and that it will be kept up to date with future membership changes via /sync. (Per Element-web makes invalid assumptions about room membership changes with lazy-loading element-web#27285, this is technically incorrect, but normally close enough.)
• More events arrive:

            E1
          ↗    ↖
         |      S2
         |      ↑
         E3     |
         ↑      |
       --|------|----
         |      |
         E4     |
          ↖    /
            E5
  

• Lazy-loading client does an incremental sync. Even though the state has changed between the previous and new token, S2 is still filtered out due to lazy-loading.

Now, unlike the gappy sync case, we can't really blame this on the client: there is no indication that events or state may be missing, though per matrix-org/matrix-spec#942 (comment) it would be nice if the spec actually told us the right thing to do here.

Anyway, I think really this is a consequence of #16940: if that were fixed, then we wouldn't be in the situation of needing to send S2 in the incremental sync.

I'm calling it out as a separate issue because:

• The trigger conditions are a bit different.
• We could work around it by disabling lazy-loading for all incremental syncs, and indeed maybe we should.