Your problem seems to be investigated on the GeoServer developer mailing list in this thread
Summary
Cascading WMS from the Polish geoportal is failing because the server does not accept Java as a User-Agent in the http headers.
I recommend to contact the administrators of the geoportal because this behavior it preventing the use of the WMS service with all Java based clients which are configured to send the jre version as User-Agent. IMHO it is a normal and right thing to do. It is hard to believe that blocking clients that way by http User-Agent headers from a national INSPIRE view service is intentional.
This is more of an extended comment than a complete answer.
I note you have to tell QGIS to ignore the GetMap / GetFeatureInfo URIs advertised in the GetCapabilities response. The service is HTTPS, the advertised URIs are all HTTP. I note too in QGIS that if you don't ignore these URI's you don't get a map... and the request goes to https:///.../index.html?, so that's the same error you are getting with the GetLegendGraphic, there is no graphic at that location, and there is no way of telling QGIS to ignore the advertised GetLegendGraphic location.
When you go to the advertised location for the GetLegendGraphic in a browser, the service redirects you to a graphic at an HTTPS address.
http://secure.erlangen.de/arcgiser/services/Luftbild2016/MapServer/WmsServer?request=GetLegendGraphic%26version=1.3.0%26format=image/png%26layer=0
This redirection fails in QGIS.
I'm not sure if this is a bug with QGIS, or a bug with the redirection in the service, or both. Certainly it seems an error for the GetCapabilities response to advertise URLs that are incorrect.
Best Answer
This may be more of an extended comment than answer but, Google Earth is correct in identifying that the WMS 1.3.0 service is giving an invalid response.
For example, the name of the service cannot be
<Name>CadastralLayers</Name>
for a WMS 1.3.0 response it must be<Name>WMS</Name>
Also the
MinScaleDenominator
andMaxScaleDenominator
in all the layers are in the wrong order, that is the service has:but it needs to be: