Change duplicate package status code to 403

Registry no longer sends 406 (since bower/registry@74ae4d34b) so clients would previously just see "Unknown error: 403 if they tried to register a duplicate package.