We are a creating zoom app of type user managed, which is not published yet and when providing home url under Features->Surface, It showing home url not reachable error.
Your home page needs to be an open, available URL on the internet. Zoom needs to be able to redirect to the URL, and you need to have it approved on your list below, where you declare the page.
This page is a page on your server which Zoom is going to report to and send your app to.
403 sounds more like an error with your hosting setup, not Zoom
OWASP errors are to do with the page being secure and not letting things like cross scripting. You will need to look this up separately, but I would not expect that to create a 403 unless you have made a mistak in locking it down,