Clarify rule 4.3.1 of the auth rules in room version 11 to state which event's `sender` the `state_key` needs to match.