Clamp the "to" token for /rooms/{roomId}/messages to when the user left

the room.

There isn't a way for the client to learn a valid "to" token for a room
that they have left in the C-S API but that doesn't stop a client making
one up.

synapse/handlers/message.py

@@ -120,6 +120,10 @@ class MessageHandler(BaseHandler):
             if source_config.direction == "f":
                 if source_config.to_key is None:
                     source_config.to_key = str(leave_token)
+                else:
+                    to_token = RoomStreamToken.parse(source_config.to_key)
+                    if leave_token.topological < to_token.topological:
+                        source_config.to_key = str(leave_token)
 
         yield self.hs.get_handlers().federation_handler.maybe_backfill(
             room_id, room_token.topological