OpenAPI compliance: avoid $ref siblings (#1457)

This strives to fix all remaining cases where additional attributes
(most often 'description' but not only) are provided next to $ref
by wrapping $ref in allOf; and also drops allOf in a couple of places
where $ref is the only element under it.

data/api/server-server/definitions/event-schemas/m.device_list_update.yaml

@@ -85,7 +85,8 @@ allOf:
             description: |-
               The updated identity keys (if any) for this device.  May be absent if the
               device has no E2E keys defined.
-            $ref: ../../../client-server/definitions/device_keys.yaml
+            allOf:
+              - $ref: ../../../client-server/definitions/device_keys.yaml
         required:
           - user_id
           - device_id

data/api/server-server/definitions/event-schemas/m.signing_key_update.yaml

@@ -37,8 +37,8 @@ allOf:
             description: The user ID whose cross-signing keys have changed.
             example: "@alice:example.com"
           master_key:
-            type: object
-            $ref: ../../../client-server/definitions/cross_signing_key.yaml
+            allOf:
+              - $ref: ../../../client-server/definitions/cross_signing_key.yaml
             example: {
               "user_id": "@alice:example.com",
               "usage": ["master"],
@@ -47,8 +47,8 @@ allOf:
               }
             }
           self_signing_key:
-            type: object
-            $ref: ../../../client-server/definitions/cross_signing_key.yaml
+            allOf:
+              - $ref: ../../../client-server/definitions/cross_signing_key.yaml
             example: {
               "user_id": "@alice:example.com",
               "usage": ["self_signing"],