It seems that the GetToken method is broken at the moment.
The path for the URL is taken from the attestEndpoint field on the GetTokenArgs struct.
Since attestEndpoint is unexported, and there are no constructor functions that set this field, there is no way for a user to provide GetTokenArgs with the attestEndpoint field set to a non-empty string.
This then results in requests to / instead of the /appraisal/v2/attest path, which then results in a 403 error.