Server-server authentication doesn't specify what happens when auth fails

[turt2live]

Link to problem area: https://spec.matrix.org/v1.7/server-server-api/#authentication

Issue
I believe it's a 401 M_FORBIDDEN error, but we need to specify that.

[richvdh]

Synapse raises a 401 M_UNAUTHORIZED in the event of an invalid signature (https://github.com/matrix-org/synapse/blob/v1.84.1/synapse/crypto/keyring.py#L345-L355) and in other situations such as a missing Authorization: X-Matrix header.

(It seems to me it should be a 401 for a missing header, and a 403 for an incorrect signature)