feat: Linting for 4xx status code rules

As a follow on to the docs update, this rule adds checks to ensure all 4xx
status codes conform to our standards.

jsonapi.yaml

@@ -149,7 +149,7 @@ rules:
                   type: object
               required: [data, jsonapi, links]
               additionalProperties: false
-  
+
   jsonapi-patch-response-204-schema:
     description: JSON:API patch 204 response should not have content
     message: '{{error}}'
@@ -169,6 +169,16 @@ rules:
       functionOptions:
         match: '^201|[3-5][0-9]{2}$'
 
+  jsonapi-4xx-response-codes:
+    description: 'Only 400, 401, 403, 404, 409, and 429 status codes can be returned in the 4xx.'
+    severity: error
+    given: $.paths[*].*.responses
+    then:
+      field: '@key'
+      function: pattern
+      functionOptions:
+        match: '^(40[0|1|3|4|9]|429)|([2|3|5][0-9]{2})$'
+
   jsonapi-created-response-location:
     description: Post responses must include a location header for the created resource
     severity: error