[SR] Add a setting to use 404s instead of 403s when trying to access user pages without the proper permission

[klonos]

This is a follow-up to #4696 and another good candidate for #3624

See:

• https://www.drupal.org/project/username_enumeration_prevention/issues/2133887
• https://git.drupalcode.org/project/username_enumeration_prevention/-/commit/12e317668ae9680bde05d1b830f921f528cd1f0b

[izmeez]

This may be important. Any visit to a url such as example.com/user/n either returns 403 Forbidden, where users exist or a 404 page not found where users do not. Returning a consistent 404 may be better.

[kiamlaluno]

The 403 error is returned only in the case the user account exists and the account used to access the user profile does not have the View user profiles permission.