Symfony version(s) affected: 3.4.25

Description
Symfony now returns 403 instead of 401 for unauthorized users.

How to reproduce

1. Create controller with a security voter like $this->denyAccessUnlessGranted(...)
2. Try to access this route with an unauthorized user
3. Observe different status codes (401 in 3.4.24 vs 403 in 3.4.25)

Possible Solution
Undo this change, or at least provide instructions how to revert to old behavior, or at least mention it explicitly in the changelog / upgrade files.
Even if the change is good (IMO 403 is better, see http://www.dirv.me/blog/2011/07/18/understanding-403-forbidden/index.html) this is a BC Break for apps that react on 401 status but not on 403.