Add an assertion on prev_events in create_new_client_event (#8041)

I think this would have caught all the cases in
https://github.com/matrix-org/synapse/issues/7642 - and I think a 500 makes
more sense here than a 403