Event auth rules are not correctly followed

[richvdh]

As per #6605 (comment):

Different code paths use different values of auth_events when performing event auth: some use a locally-calculated set of events, whereas others use the auth events provided by the event itself.

The spec says:

The receiving server must ensure that the event:
...

• Passes authorization rules based on the event's auth events, otherwise it is rejected.
• Passes authorization rules based on the state at the event, otherwise it is rejected.

This is not happening correctly, which allows malformed events into the state of the room.