BUG - Change expired http status code from 403 to 401

[rtisma]

As per oauth spec:
https://tools.ietf.org/html/rfc6750#section-3.1

expired tokens are considered "invalid tokens" which are a 401 error
"insufficent scope" are 403 errors

This is a breaking change since the expected error is changing. Not high priority, since a 400-level error is thrown. Its just not the right type.

This applies to the JWT tests for expired aswell

[leoraba]

Findings:

• Song allows the using of expired apiKeys. issue reported in 2020 (issue Song Accepts Expired API-Keys #585 )
• There is no validation in Song to check the expiration date of the apiKeys.
• Song delegates the logic to validate an apiKey by calling Ego POST /o/check_api_key , said operation is not checking expiration dates on apiKeys (EGO issue #725)

[leoraba]

Closing this issue. as the current code behaves different, as described in the previous comment.