fix(amber): return 403 instead of 401 when a user lacks access to an execution - #9325

### What changes were proposed in this PR?

Nothing can merge into main right now. Every job that sets up sbt
(`amber`, `amber-integration`, `platform` ×6, `platform-integration` ×6,
`Bench`, the image builds and the dependency graph) has died at `Setup
sbt launcher` since 2026-11-05 15:36 UTC, on main itself and on every
PR, so `Required Checks` is red and the merge queue takes nothing.
Nothing in this repository changed: main at `312a0cefc` (apache#9325, run at
07:16 UTC) was green, main at `8b0fb168e` (apache#8848, run at 20:54 UTC) is
red, and that commit touches three frontend files.

Before: Scala job -> sbt/setup-sbt v1.5.12 -> "Verify the sbt
distribution signature" reads carabiner-dev/policies at HEAD -> ampel
v1.3.6 cannot parse it -> exit 1 before sbt is installed
After: Scala job -> sbt/setup-sbt v1.5.14 -> the same step reads the
policy pinned at carabiner-dev/policies@971d670e9 -> sbt installs -> the
job runs

Root cause. v1.5.12 hands `carabiner-dev/actions/ampel/verify@32587e8`
(ampel v1.3.6) the policy argument
`git+https://github.com/carabiner-dev/policies#signature/signature.json`,
with no ref, so the policy is whatever that repository's main holds at
run time. On 2026-11-05 `signature/signature.json` gained a `meta.name`
field that ampel v1.3.6 rejects, and ampel exits while loading the
policy with `compiling policy: unable to parse a policy, group or
policySet from data`. The step's `fail: false` covers a failed
verification verdict, not the loader exiting, so the composite action
fails and the job stops. sbt/setup-sbt#155, released as v1.5.14 the same
day, pins the policy to
`carabiner-dev/policies@971d670e93f2fb4da304b0e5f071066dc4686a5a`, a
commit without the field.

Change. All 9 call sites (`build.yml` ×4, `build-and-push-images.yml`
×3, `benchmarks.yml`, `dependency-graph.yml`) move from
`ecad189dd245444b9ae0a0cd5922fd938b88906f` (v1.5.12) to
`67d461eba2c4753196c230e02da850757ba4775e` (v1.5.14), as apache#9100 moved
them to v1.5.12. Between the two versions `action.yml` differs in two
lines: the policy pin above and the default `sbt-runner-version` (2.0.10
-> 2.0.12), which this repository does not use because
`project/build.properties` sets `sbt.version`. The nested actions,
`actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` and
`carabiner-dev/actions/ampel/verify@32587e82f960d49b36101e8c45d1956e511965d3`,
are the same in both, and no call site passes inputs.

Scope. v1.5.13 is already on the ASF allow list but carries the same
unpinned policy line, so it fails the same way; v1.5.14 is the first
version that does not. This PR changes nothing about what the signature
step does when it runs; it only stops the step from reading a moving
target.

**Blocked on apache/infrastructure-actions#1498.**
`sbt/setup-sbt@67d461eba` is not on the ASF actions allow list yet;
apache#1498 (opened 2026-11-05 13:39 UTC) adds it. Until it merges, every sbt
job on this PR fails at `Set up job` with the action not allowed, which
is how v1.5.7 failed in apache#9100, so the red checks here are expected and
this PR must not be merged before apache#1498 lands. Once it does, a re-run of
the failed jobs is the proof; nothing in this branch needs to change.

### Any related issues, documentation, discussions?

Closes apache#9345.

Upstream fix: sbt/setup-sbt#155 (v1.5.14). Allow-list entry:
apache/infrastructure-actions#1498. Precedent: apache#9100 moved the same 9
call sites to v1.5.12 after the ASF allow list dropped the actions
v1.5.7 reached, with backports apache#9132 (v1.3) and apache#9133 (v1.2); apache#7710 and
apache#6990 are the earlier bumps of the same kind.

### How was this PR tested?

Every changed file parses:

```
python -I -c "import sys, yaml; [yaml.safe_load(open(f, encoding='utf-8')) for f in sys.argv[1:]]" .github/workflows/build.yml .github/workflows/build-and-push-images.yml .github/workflows/benchmarks.yml .github/workflows/dependency-graph.yml
```

`git ls-remote --tags https://github.com/sbt/setup-sbt.git` resolves
`refs/tags/v1.5.14^{}` to `67d461eba2c4753196c230e02da850757ba4775e`.
Diffing `action.yml` at `ecad189` against `67d461eba` shows only the two
lines described above, with identical `uses:` lines. Walking the `uses:`
chain under v1.5.14 reaches `ampel/verify@32587e8`, which is in
`apache/infrastructure-actions` `approved_patterns.yml`;
`sbt/setup-sbt@67d461eba` itself is not yet, which
apache/infrastructure-actions#1498 adds.

The rest is CI. The labeler applies `ci` for `.github/**`, which runs
every stack that sets up sbt. Those jobs cannot pass until
apache/infrastructure-actions#1498 lands (see above); the re-run after
that is the test, and the checks on this PR are the first run of v1.5.14
in this repository.

### Was this PR authored or co-authored using generative AI tooling?

Yes. Generated-by: Claude Code (claude-fable-5-1). Co-authored with
Claude; the author reviewed the change before submission.