acl: error when an unknown key exists in an hcl ACL policy

Currently any unknown keys are ignored. So if a rule is misspelled the policy is still saved. The problem won't be noticed until the policy is assigned to a token, and someone tries to use the token.

I attempted to make this work with `hclv1` `unknownKeys`, but that doesn't quite work because the names of resources are reported as unknown keys. Nomad addresses this problem with something like this: https://github.com/hashicorp/nomad/blob/1bd132f/helper/funcs.go#L442

Fixing this may require upgrading to hclv2.