Allow api to return results for folders where access is granted to sub folder contents.

#### Problem:
Currently if a an ACL policy grants permission to a subfolder such as "config/AB/" and the default policy is deny. Then when a user with that ACL policy navigates to the root kv path no results are returned. It can be resolved by granting read access to "config/" but then additional unintended access is granted.

#### Example
An example of such a policy:

```
key "" {
policy = "deny"
}

key "config/AB/" {
policy = "read"
}
```
In this example there would be multiple teams with their own subfolder under the common config folder. Each team should have access to write to their config, and for their apps to read from their config folder, but have no access to each others configs. This works fine from the app perspective since the app would retrieve data directly from the full path, but it can make the UI difficult or confusing to navigate.

#### Solutions:
A work around is to only have config-AB and config-BC folders, but then a flat hierarchy is artificially necessitated by ACL limitations.

Solution via ACL expansion:
This could be implemented as a new ACL permission that could be added to a folder that allows it to be viewed but grants no additional read or write access inheritance.

Solution via API expansion:
As proposed by @banks: "have GET /v1/kv/?recurse still work even if the token has no permission to read the root directly." If the ACL allows access to any keys within the path then a filtered result is returned that will allow navigation to that data. There is a concern about the cost of that repeated filtering on a large complex data set.

#### Use Cases:

When the business workflow is to have configurations manually entered or visually verified through the UI by persons with necessarily limited access specific to those configurations, it is an issue that data appears to disappear when navigating to the root of the kv path.

#### Related Issue:
https://github.com/hashicorp/consul/issues/4324#