Encrypted history sharing: design to-device message format

[richvdh]

Our proposed solution to sharing encrypted room history on invite involves sharing the keys to an encrypted blob via to-device messages.

This issue tracks the creation of a format for those to-device messages. Likely they will be based on the encrypted attachment format.

[richvdh]

(We considered incorporating some security improvements to fix issues highlighted in Lotte's blog post. However, those attacks seem even harder to exploit in this application than in regular encrypted media, so that remains TBD)