[Bug]: when include and exclude configurations are invalid, we don't catch it.

## Invalid configuration should not `validate`.

Today this starts, passes validate and also hot reloads successfully when it should fail.

```json
"permissions": [
{
"role": "anonymous",
"actions": [
{
"action": "*",
"fields": {
"include": ["Id"],
"exclude": ["Id"]
}
}
]
}
],
```

I am also not sure this error message helps the developer debug the situation. And it should.

```json
{
"error": {
"code": "AuthorizationCheckFailed",
"message": "Authorization Failure: Access Not Allowed.",
"status": 403
}
}
```

This implies we are asking for a field that is not available, but we are actually just asking for the entity. It's confusing.

Can we append to the error message? `include and exclude field configuration is invalid.`