to-device messages that have been sent to appservices aren't deleted

[matrixbot]

This issue has been migrated from #11423.

---

Split out of matrix-org/synapse#10653, and deliberately removed from the scope of matrix-org/synapse#11215.

Application services can receive to-device messages intended for the devices of users that reside within their namespace. Note that both local and remote users can be included here.

From conversation in matrix-org/synapse#10653, the plan is to only delete delivered to-device messages if the responsible namespace is marked as exclusive. If so, it is assumed that no other application service nor user device will be also trying to receive these to-device messages. And thus they can be safely deleted.

Ideally we would add this after matrix-org/synapse#11150, as it's a bit terrifying to delete messages without knowing whether they've been successfully delivered or not.