Forbidden/403 responses should not show a querystring with ReturnUrl

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Suppose one is using Identity, and the StatusCodePages middleware (where the error page's URL is `/error`.

When a request to an authorised resource is forbidden (403), a redirect is automatically made to the error page, and the browser's URL is changed to `/error?ReturnUrl=%2Ffoobarbaz`.

### Expected Behavior

The browser URL should be `/error`, not `/error?ReturnUrl=%2Ffoobarbaz`.

That behaviour makes sense for a 401/Unauthorized scenario - it would redirect to the login page, and after successful login, that querystring can be used to redirect to the originally-requested page. But it makes no sense in the 403/Forbidden scenario.

### Steps To Reproduce

Visit any page that responds with 403.

### Exceptions (if any)

no

### .NET Version

7

### Anything else?

I documented a workaround on [StackOverflow](https://stackoverflow.com/a/78370091/9971404), but it runs on every 403 event, which seems like a massive waste of time.

This is (probably?) a bug, which should be fixed.