When we return events to clients we need to annotate them with the membership of the user at the time of the event, in the unsigned section. We already check the membership at the event during the visibility checks, and so we annotate events there. However, since this a per-user field we end up having to clone the event in question.

Instead, let's add a FilteredEvent class that is returned by the visibility checks, which allows returning the membership without editing the event. This has three benefits:

1. Avoids the clones of the event.
2. Allows us to statically check that we have filtered events before returning them to clients.
3. We no longer edit unsigned data after event deserialization, this makes it easier to port the event class to Rust.

The last benefit is why we're doing this now, however IMV it shouldn't affect whether we want this change or not.

Reviewable commit-by-commit