Allow 403 response from Auth Webhook to client

It would be valuable to be able to send a 403 Forbidden response to Hasura and have Hasura pass that code through to the client so that we can determine the difference between unauthenticated and unauthorized requests.

For example:

1. Someone with an expired or invalid token would get a 401 and need to log back in.
2. Someone who was sent a link to a resource they should not be allowed to access would get a 403 and a nice message telling them they need permission to access the resource.

Start by locating Auth Webhook response handling and its existing tests in the repository. Trace how 401 responses reach Hasura clients, then determine where a 403 response should be preserved. Done means clients can distinguish unauthenticated 401 responses from unauthorized 403 responses.

Written by the indexing model from the issue text.