* Support MSC4189 (uploaded media access for guests)

* Add to changelog

* Add test coverage

* Move changelog line from "Fixed" to "Added"

* Actually check for guest users

* Fix test: expect guests to access thumbnails

* Return 403 (not 500) for forbidden guest access

* In tests, replace loops with duplicate blocks

so that test failures will give a more useful stack trace.

* Return types, not variables

* Replace new access control function with parameter

Instead of defining a whole new access control function for guest
access, update the existing token-access function to optionally allow
tokens of guest users.

---------

Co-authored-by: Travis Ralston <travis+github@t2bot.io>