Add configurable allowlist for setting custom profile fields

[anoadragon453]

Fixes #18525

This PR adds a new config option to the experimental implementation of MSC4133 that forbids users from adding/updating certain profile keys unless that key is on the allowlist. This does not affect setting a user's displayname or avatar URL.

Note: MSC4133 has been accepted, and the implementation should be stabilised. This can happen as a follow-up to this PR though. As the implementation is not stable, no config documentation has been written.

Note: This PR was mostly written by OpenAI Codex, before being reviewed by myself. Commits written by Codex are marked as those made by @anoadragon453-codex. Please use extra caution when reviewing them.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct (run the linters)