AP C2S: remove check for local user since user is already authenticated

Before a request arrives to update_outbox, it already passed through out
Plug authentication (:authenticate), so at this point all users should
be local.

Also adds Listen Activities to the list of allowed Activities that don't
need an existing normalized object referenced in them.

lib/pleroma/web/activity_pub/activity_pub_controller.ex

@@ -489,8 +489,9 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
       {:ok, activity}
     else
       {:normalize, _} ->
-        if user.local and type == "Create" do
-          # Creating new object via C2S
+        if type in ["Create", "Listen"] do
+          # Creating new object via C2S; user is local and authenticated
+          # via the :authenticate Plug pipeline.
           {:ok, activity}
         else
           {:error, "No such object found"}