consul validate acts inconsistent on field names

#### Overview of the Issue

Validation recommends to not use deprecated field names but fails when using the proposed ones.

```
root@nc-2:~# consul validate /etc/consul.d/consul.hcl
The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
Configuration is valid!

root@nc-2:~# consul validate /etc/consul.d/consul.hcl
Config validation failed: failed to parse /etc/consul.d/consul.hcl: 6 errors occurred:
* invalid config key tls.internal_rpc.verify_server_hostname
* invalid config key tls.defaults.verify_outgoing
* invalid config key tls.defaults.verify_incoming
* invalid config key tls.defaults.key_file
* invalid config key tls.defaults.ca_file
* invalid config key tls.defaults.cert_file
```

#### Reproduction Steps

I used this config in `/etc/consul.d/consul.hcl`:
In first call without the tls... qualification then with them in call 2.

```
datacenter = "dc1"
data_dir = "/opt/consul"
encrypt = ""
tls.defaults.ca_file = "/etc/consul.d/consul-agent-ca.pem"
tls.defaults.cert_file = "/etc/consul.d/dc1-server-consul-2.pem"
tls.defaults.key_file = "/etc/consul.d/dc1-server-consul-2-key.pem"
tls.defaults.verify_incoming = true
tls.defaults.verify_outgoing = true
tls.internal_rpc.verify_server_hostname = true
retry_join = [" 10.0.0.3", "10.0.0.21", "10.0.0.22"]
bind_addr = "{{ GetPrivateInterfaces | include \"network\" \"10.0.0.0/8\" | attr \"address\" }}"

acl = {
enabled = true
default_policy = "allow"
enable_token_persistence = true
}

performance {
raft_multiplier = 1
}
```

### Consul info for both Client and Server
Consul v1.12.3
Revision 2308c75e

### Operating system and Environment details

Ubuntu 20.04

Begin at the `consul validate` command and the TLS fields shown in the reproduction, then trace how deprecated top-level names are translated into nested names. Done means the names recommended by validation are accepted by `consul validate` and the reproduced HCL remains valid; use that configuration as the regression case.

Written by the indexing model from the issue text.