Improve ACL errors context to make figuring workable ACLs out simpler

ACLs in consul are a mess to navigate through. Any given agent may be making requests with half a dozen different tokens (acl.tokens.default, acl.tokens.agent, service.token, consul connect envoy ...) and it's not clear which token is being used when a permission error occurs. It also doesn't help me to know which permission is missing.

The guides and documentation are not super well organized around ACLs to even know which permissions are going to be needed for which purposes, so ACLs are already a game of whackamole. The error messages giving more context would be a huge step forward; at least then I know where the moles are to be able to whack them.

#### Feature Description

In general, every "permission denied" error should show the Accessor ID and "slot" (acl.tokens.default, acl.tokens.agent, etc) that the token came from, to hint to the user which type of request uses which token "slot"

Start by tracing Consul's permission-denied error paths and the handling of ACL token slots named in the issue, including acl.tokens.default and acl.tokens.agent. Identify how the Accessor ID and denied permission can be made available across those paths; done means permission errors consistently expose the token context and missing permission, with focused tests for the affected cases.

Written by the indexing model from the issue text.