Return REST error when fetching expired login/registration/profile request

[aeneasr]

Describe the bug

Currently, expired login/registration/profile requests return the full payload. This could be used in brute-force or other guessing attacks, which could lead to leaking of PII.

Instead, expired requests should just return an error (e.g. HTTP GONE)

[akkie]

@aeneasr Is there a reason why a response for a expired flow is returned in the following form, instead of using the same structure as documented in: https://www.ory.sh/docs/kratos/concepts/ui-user-interface#ui-error-codes

{
  code: 410,
  status: 'Gone',
  reason: 'The settings flow has expired. Redirect the user to the settings flow init endpoint to initialize a new settings flow.',
  details: {
    redirect_to: 'https://my.app/kratos/self-service/settings/browser',
    return_to: ''
  },
  message: 'The requested resource is no longer available because it has expired or is otherwise invalid.'
}

Could this not be unique?

[aeneasr]

True, we will need to streamline the different error states!