Mark instances as unreachable when returning a 403 from an object fetch

This is a definite sign the instance is blocked and they are enforcing authorized_fetch

test/pleroma/object/fetcher_test.exs

@@ -25,6 +25,9 @@ defmodule Pleroma.Object.FetcherTest do
       %{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
         %Tesla.Env{status: 404}
 
+      %{method: :get, url: "https://octodon.social/users/cwebber/statuses/111647596861000656"} ->
+        %Tesla.Env{status: 403}
+
       %{
         method: :get,
         url:
@@ -233,6 +236,18 @@ defmodule Pleroma.Object.FetcherTest do
                )
     end
 
+    test "handle HTTP 403 response" do
+      object_id = "https://octodon.social/users/cwebber/statuses/111647596861000656"
+      Instances.set_reachable(object_id)
+
+      assert Instances.reachable?(object_id)
+
+      assert {:error, "Object fetch has been denied"} ==
+               Fetcher.fetch_object_from_id(object_id)
+
+      refute Instances.reachable?(object_id)
+    end
+
     test "it can fetch pleroma polls with attachments" do
       {:ok, object} =
         Fetcher.fetch_object_from_id("https://patch.cx/objects/tesla_mock/poll_attachment")