[web] return 403 for Unauthorized, not 401
401 is reserved to HTTP authentication. Just because it's also called
"unauthorized" doesn't mean it's the same as cubicweb's Unauthorized
exception. Closes #3648809.
usr/lib/PY_VERSION/*-packages/cubicweb/server/
usr/lib/PY_VERSION/*-packages/cubicweb/hooks/
usr/lib/PY_VERSION/*-packages/cubicweb/sobjects/
usr/lib/PY_VERSION/*-packages/cubicweb/schemas/
usr/share/cubicweb/migration/