fix: don't perform identity assertion on appservice-only endpoints

This for example, allows appservices to ping before creating any users

src/api/ruma_wrapper/axum.rs

@@ -126,10 +126,7 @@ where
                         ));
                     }
                 }
-                (
-                    AuthScheme::AccessToken | AuthScheme::AppserviceToken,
-                    Token::Appservice(info),
-                ) => {
+                (AuthScheme::AccessToken, Token::Appservice(info)) => {
                     let user_id = query_params
                         .user_id
                         .map_or_else(
@@ -163,6 +160,7 @@ where
                 }
                 (
                     AuthScheme::None
+                    | AuthScheme::AppserviceToken
                     | AuthScheme::AppserviceTokenOptional
                     | AuthScheme::AccessTokenOptional,
                     Token::Appservice(info),