Clarify and document the user state machine

[sandhose]

A user can currently be in three states on the MAS side:

• active
• locked
• deactivated

These have implications on the homeserver side, which need to be fully fleshed out and documented.

We're also missing other states from Synapse, like "suspended" or "shadow banned". We should make sure with the T&S team that we have the right states defined and the right behaviour for each of those.

[matrixbot]

For your information, this issue has been copied over to the Element fork of matrix-authentication-service: element-hq/matrix-authentication-service#2978