Send validation tokens to submit_url from HS

[jryans]

Cloned from element-hq/element-web#10923

As part of MSC2078, requestToken calls to the HS (during registration, add to HS account, password reset) may return a submit_url field which should be used if present as the place to send validation tokens.

Per spec this could happen for both email and MSISDNs, but at this stage Synapse only intends to use it with MSISDNs.

If submit_url is present, clients should ask the user for the validation token and submit it to the supplied URL, structuring parameters in the same way as the IS POST /validate/email/submitToken API. (You should assume it's a v1-style endpoint without authentication.)

Synapse work tracked in matrix-org/synapse#6076.