Audit response status code for information disclosure

[hug-dev]

Mitigation one of our threat model says:

Response statuses are audited to not give too much information to the client.

This issue is to investigate and make sure this is the case.

[ionut-arm]

By this I assume we mean only the non-PSA response codes. Also, it only means the response code alone, since we send back no data about the failure, just a number.

[hug-dev]

The service specific response codes are defined here. Having looked at it, the information they contain is either public or not confidential.