Allow returning a 403 instead of redirecting to the custom access denied controller

rossb89 → changed the visibility of the branch 3498739-allow-returning-a to hidden.

rossb89 → changed the visibility of the branch 3498739-allow-returning-a to hidden.

rossb89 → changed the visibility of the branch 3498739-allow-returning-a to active.

I have tested the changes

Here are the changes:

UI changes:

Before:

After:

Moving it to RTBC
Thank You

Will need test coverage and an upgrade hook.

Thanks for the feedback thus far.

I've added a test for the new option, tweaked the #states visibility of the option on the config form to match the logic in the event subscriber and added an update hook to set the new option into config with a default of FALSE.

The patch successfully introduces a new configuration option (return_403) that allows users to return a 403 Access Denied response instead of redirecting to the custom access denied page or front page. It properly updates the module’s configuration schema, ensures backward compatibility with an update hook (restrict_ip_update_500003), and modifies the event subscriber to handle this new option. Additionally, a UI checkbox is added to the configuration form.
It's working fine for me, hence moving the issue to RTBC.