Using the Downloader is the, arguably, most convenient workaround, but here's how it works:
Our browser download links are (among other things) IP-sensitive, to accommodate browser download resuming while remaining secure.
This works under normal circumstances, but, unfortunately, we have learned that, in very rare cases, if a user's connection assigns a different IP when connecting to our site, and then a different IP when the actual download is initiated with our file hosting provider, an IP mismatch occurs, resulting in the 403 error. We are currently unable to resolve this issue, whilst preserving our users' ability to resume browser downloads.
If you've set up a proxy connection yourself, you should make sure that the same proxy is used for all connections, rather than only some of them.
If all of this happens in your ISP's back-end, it may be possible for your network administrator to modify your network setup so that you are issued the same IPs for both GOG.com, and our file hosting provider's servers, which you eventually get redirected to. Unfortunately I cannot guarantee if this will work, nor if the network administrator would agree to making such a change.