Clarify and document the user state machine

[matrixbot]

This issue was originally created by @sandhose at matrix-org/matrix-authentication-service#2978.

A user can currently be in three states on the MAS side:

• active
• locked
• deactivated

These have implications on the homeserver side, which need to be fully fleshed out and documented.

We're also missing other states from Synapse, like "suspended" or "shadow banned". We should make sure with the T&S team that we have the right states defined and the right behaviour for each of those.