Hi,
I think you're getting a "Forbidden" error because in your cloud connector the sub paths of /sap/opu/odata are excluded, and you can see the request is trying to access /sap/opu/odata/IWFND/CATALOGSERVICE/$metadata.
Try to include the sub paths (I recommend to include them in /sap/bc/ui5_ui5 as well).
Regards,
Michal.