`PUT` on CalDAV collection should return 403 instead of 404

Hi,

As long as there's no write access to Deck's CalDAV collections, the server restricts write access as expected. However, it returns 404 instead of 403.

Steps to reproduce:

1. Upload (PUT) a task (VTODO) to a Deck CalDAV collection.

Actual result:
Currently, it returns 404 Not found when you try to upload a task.

Expected result:
Deck should return 403 Forbidden:

https://tools.ietf.org/html/rfc3744#section-3
Servers MUST report a 403 "Forbidden" error if access is denied, except in the case where the privilege restricts the ability to know the resource exists, in which case 404 "Not Found" may be returned.

Because the client has read access, it knows which resources exist and thus there's no need for 404.

The response body should contain:

https://tools.ietf.org/html/rfc3744#section-7.1.1
If an HTTP method fails due to insufficient privileges, the response body to the "403 Forbidden" error MUST contain the DAV:error element, which in turn contains the <DAV:need-privileges> element, which contains one or more <DAV:resource> elements indicating which resource had insufficient privileges, and what the lacking privileges were: […]

With 403 and <DAV:need-privileges>, clients can show a meaningful error message.

Tested with:
Nextcloud 20, Deck 1.1.0

Start by reproducing the PUT of a VTODO to a Deck CalDAV collection with read access, then trace the CalDAV permission handling that produces the current 404 response. Done means the request returns 403 Forbidden and its response body includes DAV:error with DAV:need-privileges identifying the missing privilege.