Wrong error response if user lacks of permission to create/edit a link over a space

## Describe the bug

Creating/Editing a space link with incorrect permissions returns a `400` instead of a `403` , causing a wrong error message in clients.

## Steps to reproduce - Actual behavior

The following `curl` creates a link over a space.

```
curl -H 'Authorization: Bearer xxx' \
-X POST 'https://xx.xx.xx.xx:9200/graph/v1beta1/drives//root/createLink' -d '{"displayName":"test","password":"...","type":"view"}'
```

If the user is not allowed to perform that actions, server returns with a `400` and the following payload:

```
{
"error": {
"code": "invalidRequest",
"innererror": {
"date": "2026-04-01T11:31:31Z",
"request-id": "1b253441-34b5-4324-856e-041d18be46ea"
},
"message": "no share permission"
}
}
```

Same for edit operation

## Expected behavior

Error code should be `403 Forbidden` instead of `400`

## Setup

Start by tracing the API handlers for the createLink endpoint and the corresponding edit operation, then follow how the "no share permission" error is mapped to an HTTP status. Reproduce the request with insufficient permissions and verify that both operations return 403 Forbidden with the existing error payload.

Written by the indexing model from the issue text.