Do not return 5xx for invalid/expired recovery mode cookies

[david.binda]

The WP_Recovery_Mode class dies in certain situations where returning a 5xx status code does not feel appropriate, as the request did not produce a server error, but rather the authentication failed. In such situations, it might be more appropriate to return a 4xx error (presumably 403). The situations in mind here are the following:

1. when the recovery mode cookie is expired
2. when the recovery mode cookie is invalid
3. when the exit recovery mode nonce check failed

As those failures also unset related cookies, the 5xx status may result in an improper handling on certain server configurations (eg.: overriding 5xx responses with a custom response which is not properly passing the cookie headers).

I'm attaching a patch which changes the response codes from default 500 to 403 in the cases mentioned above.

[spacedmonkey]

@davidbinda This looks good.

For calls to wp_die that pass a WP_Error object. Please add the status code like ​this.

[david.binda]

Thanks for the feedback @spacedmonkey ! I've updated the patch accordingly, please let me know if it works for you :)

[spacedmonkey]

Assigning to @SergeyBiryukov to merge.

[SergeyBiryukov]

In 45544:

Bootstrap/Load: Return a 403 error code when the recovery mode cookie is invalid or expired, or the exit recovery mode nonce check failed.

Props david.binda, spacedmonkey.
Fixes #47479.