Exclude state events from read_events actions without a state_key

[robintown]

TBD: This might only need Element Web changes, I'm not sure yet.

https://github.com/matrix-org/matrix-spec-proposals/pull/4288 has clarified the meaning of read_events actions without a state_key: the client isn't supposed to respond with any state events. I think the current shape of the driver API assumes that the lack of a state_key should mean that any matching events - state events or otherwise - should be included in the response. We should eventually rectify this.