Log 'resourceloader.forbidden' events from readers

Follows-up f0625fe7d2a9a. No events were being logged from logged-in users,
increasing scope to sampled logged-out users. Could be cache related.

The problem definitely still exists because we're still seeing events
logged server-side with production wiki page urls as referrers.

Bug: T101806
Change-Id: Ie3084f19d03e7198ab21cb832f5a20bf14b263ff