Clarify that query string auth is forbidden

proposals/3916-authentication-for-media.md

@@ -90,6 +90,11 @@ This proposal supersedes [MSC1902](https://github.com/matrix-org/matrix-spec-pro
    which must be `Bearer {accessToken}` for `/_matrix/client`, or the signature
    for `/_matrix/federation`.
 
+   The query string `?access_token` approach is not supported on the new endpoints,
+   as it is [deprecated](https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/4126-deprecate-query-string-auth.md)
+   and [pending removal](https://github.com/matrix-org/matrix-spec-proposals/pull/4127).
+   See those MSCs for details.
+
    **Note**: This fixes [matrix-spec#313](https://github.com/matrix-org/matrix-spec/issues/313).
 
 4. Updated response format