Use of 403 for business logic errors looks not compliant with HTTP and CAMARA

[bigludo7]

Problem description
The use of 403 for business logic errors looks not compliant with HTTP and CAMARA (should be 422/409)

ONE_TIME_PASSWORD_SMS.MAX_OTP_CODES_EXCEEDED
ONE_TIME_PASSWORD_SMS.PHONE_NUMBER_NOT_ALLOWED # Validation issue - should be 422
ONE_TIME_PASSWORD_SMS.PHONE_NUMBER_BLOCKED # Business rule - could be 422
Expected behavior

Alternative solution
To be discussed and fixed.

Additional context