Add 403 Forbidden page to prevent recursive redirects

[StephenCWills]

It seems that cookie authentication in ASP.NET Core redirects 403 errors to CookieAuthenticationOptions.AccessDeniedPath by default. If a web application does not define a page and bypass authentication for that page, then the AccessDeniedPath will also return a 403 and redirect to itself until the URL or the request grow too large at which point the user will get an error in their web browser.

This PR defines a path under /asi for a simple page that produces the text Access Denied, and makes this the default value for the AccessDeniedPath. If an application wants to define its own page, it can override the default value for the AccessDeniedPath and provide its own implementation via Razor Pages or whatever.

[clackner-gpa]

@prestoncraw We may want to redirect these in OH,PDC, WaveApps to match layout/formatting of the login Page with an error message.

@StephenCWills would it be bad practice to redirect to the Login.cshtml with an extra query parameter and as error message?

[StephenCWills]

There's no way to supply an extra query parameter via the AccessDeniedPath property. Even if there was, redirecting to login when you're already logged in is a bit awkward. You should log out first, which ought to automatically redirect you to login, and doing that automatically on 403 Forbidden is a bit of a UX problem.

Also, I just discovered there's an issue with the logic in the ApplicationSecurityInterfaceMiddleware. Because it's using the cookie options to determine the AccessDeniedPath, there's no way for the application to override the page. I should have hardcoded the /asi/forbidden path instead.

[StephenCWills]

I fixed the issue. /asi/forbidden is hardcoded now.