Detect when a device expires (not just an access token) and cleanup

[DMRobertson]

As noticed here #51 (comment)

Problem: how do we distinguish between a device expiry and a token expiry?

If we don't, we'll end up keeping device-scoped data forever, in particular, to-device messages. This will be A Problem.

I mooted that

Maybe it's sufficient to look for soft or hard logouts, and expire entire devices on hard logouts?

But for this we'd have to understand how the OIDC "compatability" layer works in Synapse. Do device expiries get communicated as hard logouts, and do token expiries get communicated as soft logouts? I will need to understand what is going on and liase with @sandhose.