Use destination field in X-Matrix Authorization header

Both validating and sending it is a MUST since Matrix v1.3.

src/api/ruma_wrapper/axum.rs

@@ -196,6 +196,19 @@ async fn ar_from_request_inner(
                         Error::BadRequest(ErrorKind::forbidden(), msg)
                     })?;
 
+                if let Some(destination) = x_matrix.destination {
+                    if destination != services().globals.server_name() {
+                        warn!(
+                            %destination,
+                            "Incorrect destination in X-Matrix header"
+                        );
+                        return Err(Error::BadRequest(
+                            ErrorKind::Unauthorized,
+                            "Incorrect destination in X-Matrix header",
+                        ));
+                    }
+                }
+
                 let origin_signatures = BTreeMap::from_iter([(
                     x_matrix.key.to_string(),
                     CanonicalJsonValue::String(x_matrix.sig),

src/api/server_server.rs

@@ -242,7 +242,7 @@ where
 
     http_request.headers_mut().typed_insert(Authorization(XMatrix::new(
         services().globals.server_name().to_owned(),
-        None,
+        Some(destination.to_owned()),
         key_id,
         signature,
     )));