Add ability to return a 401 response on wrong basic auth for forward auth proxy provider

**Is your feature request related to a problem? Please describe.**

I've correctly set up authentik domain level forward auth provider to secure some web apps behind traefik.
I've developed an headless client that uses a service account and basic auth to connect to one of the services; everything works well, but if I specify wrong credentials in the basic auth, I still get a 200 response code because, as [stated in the documentation](https://docs.goauthentik.io/docs/providers/proxy/header_authentication#receiving-http-basic-authentication), "If the received credentials are invalid, a normal authentication flow is initiated", so I get the login page as response.

**Describe the solution you'd like**

Return a 401 response on invalid basic auth credentials, especially with service accounts.

Start with the domain-level forward auth provider and the linked documentation section on receiving HTTP Basic Authentication. Trace how invalid credentials are handled for service accounts and confirm the desired behavior with a headless client using wrong credentials; done means the proxy returns HTTP 401 instead of a login-page response.

Written by the indexing model from the issue text.