Move `Forbidden` exceptions to `RECOVERABLE` group

Previously the Forbidden exceptions raised by clients were classified
as UNAUTHORIZED. This classification is not entirely correct, as
the UNAUTHORIZED group of exceptions implies that the user should be
logged out and forced to log in again. This, however, is not the case
with Forbidden exceptions. Thus, it is more appropriate to place the
Forbidden exceptions into the RECOVERABLE group.

Change-Id: I7e52ed72d66e9d0496bc07036e48c968e7a66c2e
Closes-bug: #1299126
Merge "Move `Forbidden` exceptions to `RECOVERABLE` group"