[#1563] tree: Wrap only ChainRouterError erros with ObjectAccessDenied

* Such wrapping helps to differentiate logical check errors and server internal
  errors.

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>

pkg/services/tree/signature.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 
 	core "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/api/refs"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
 	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
@@ -64,12 +65,16 @@ func (s *Service) verifyClient(ctx context.Context, req message, cid cidSDK.ID,
 	}
 
 	if err = s.checkAPE(ctx, bt, cnr, cid, op, role, pubKey); err != nil {
-		return apeErr(err)
+		return processAPECheckErr(err)
 	}
 	return nil
 }
 
-func apeErr(err error) error {
+func processAPECheckErr(err error) error {
+	var chRouterErr *checkercore.ChainRouterError
+	if !errors.As(err, &chRouterErr) {
+		return err
+	}
 	errAccessDenied := &apistatus.ObjectAccessDenied{}
 	errAccessDenied.WriteReason(err.Error())
 	return errAccessDenied