Add authorizer information into PermissionDeniedByACL errors.

Connect up authorizer information with the PermissionDenied error generation code. Currently we don't have context information around the source of the authority (token, etc) at the time the error is generated.

This should implemented along the lines suggested in https://github.com/hashicorp/consul/issues/11337

This has a couple of subtasks:

1) ACLResolveResult and AllowAuthorizer should be unified. (Probably as AllowAuthorizer) Currently the ACLResolver (and ACLResolveResult) are in the agent/consul package, but for general utility it should be moved to the acl package.

For now we may keep ACLResolver in agent/consul, depending on implementation difficulty.

2) acl.Authorizer should be replaced with the new AllowAuthorizer authorizer and threaded through the call stack.

Once that is done, the error generation code should have appropriate context to identify the token used.