It looks like the only way to specify the User Agent is to modify OSMDroid's MapTileDownloader.loadTile()
method in the following way:
final HttpClient client = new DefaultHttpClient();
final HttpUriRequest head = new HttpGet(tileURLString);
head.setHeader("User-Agent", "OSMDroid"); // Add this line
final HttpResponse response = client.execute(head);
It solves the 403 Forbidden
tile download problem.