Add request- and cancel-membership endpoints

In contrast to the existing roomaccess endpoints, these use authentication and are intended to be routed publically. This allows us to move responsibility from the gateway to the authz service.