Add a separate payload for redacting state

[DMRobertson]

Part of #294.

I want to use V2InvalidateRoom to mean "gappy poll received, reload everything about the room and nuke all involved users' connections", so we can finally land #329 (or equivalent).

We already use this payload to mean "a piece of room state got redacted". In this situation we only need to reload the global cache; we don't need to nuke connections. Room state redactions happen rarely (we think) so we could get away with reusing V2InvalidateRoom for this case too. But

• it would be nice to avoid giving M_UNKNOWN_POS to clients where we can.
• ne'er-do-wells could abuse this by redacting their own state events in order to nuke connections. (AFAICS the default power levels do not impose a PL requirement for m.room.redaction.)