Client Agent with ACLs enabled do not auto-detect servers without ACLs enabled.

#### Overview of the Issue

In the process of turning ACLs on for a cluster, the client agents were configured with ACLs enabled in default allow mode. However when api clients attempted to register services to the client agents they returned `ACL not found` errors due to the anonymous not existing yet.

The intention within the `ACLResolver` was to detect that the servers do not have ACLs enabled yet and just let the request through. However there appears to be a bug here as we are [attempting to auto-disable ACLs](https://github.com/hashicorp/consul/blob/a9dcfc59bd1a98855f7c5b0229235aa11f9a4d45/agent/consul/acl.go#L1161-L1172) if the servers do not have them disabled.

In this scenario the clients would still be in legacy ACL mode due to the servers having ACLs disabled. That means that we would be using the `ACL.GetPolicy` RPC to resolve the legacy ACL which doesn't seem to [return the disabled](https://github.com/hashicorp/consul/blob/a9dcfc59bd1a98855f7c5b0229235aa11f9a4d45/agent/consul/acl_endpoint.go#L1393-L1396) error when ACLs are disabled.

I _think_ the source of the issue is a mix of the `GetPolicy` endpoint not returning the disabled error and some legacy ACL resolution code in the `ACLResolver`

#### Reproduction Steps

Steps to reproduce this issue, eg:

1. Create a cluster with some servers with ACLs disabled.
1. Attach a client agent to the servers but with the client having ACLs enabled and the default policy set to allow
1. Try to register a service with the client agent.

This returns an `ACL not found` error when we would expect it to be allowed.