Split out of #10653, and deliberately removed from the scope of #11215.

Application services can receive to-device messages intended for the devices of users that reside within their namespace. Note that both local and remote users can be included here.

From conversation in #10653, the plan is to only delete delivered to-device messages if the responsible namespace is marked as exclusive. If so, it is assumed that no other application service nor user device will be also trying to receive these to-device messages. And thus they can be safely deleted.

Ideally we would add this after #11150, as it's a bit terrifying to delete messages without knowing whether they've been successfully delivered or not.