kv_prefix with list policy not correctly applied in UI

#### Overview of the Issue
Consul UI access to the Key/Value tab is not correctly computed.

#### Reproduction Steps

1. With a master token create the following entries in the kv:

- `reverse-proxy-example/chef/test`
- `secrets-manager/test`

2. Create a policy with:
```
key_prefix "reverse-proxy-example" {
policy = "list"
}
key_prefix "reverse-proxy-example/chef/" {
policy = "write"
}
```
3. Create a token with that policy.
4. Open consul ui in browser and login with that token.
5. Try to access the Key/Value tab. You will get a "You are not authorized" message.

If you access the `reverse-proxy-example` key directly `https://my.consul.com/ui/dc1/kv/reverse-proxy-example/` you can see the chef key.

Only by adding:
```
key_prefix "" {
policy = "list"
}
```
to the policy can you open the Key/Value tab, but of course now you see too much (aka the secrets-manager keys).

### Consul info for both Client and Server

Client info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 1
build:
prerelease =
revision = 12b16df3
version = 1.8.4
consul:
acl = enabled
known_servers = 5
server = false
runtime:
arch = amd64
cpu_count = 1
goroutines = 49
max_procs = 2
os = linux
version = go1.14.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 4
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 13325
members = 11
query_queue = 0
query_time = 1
```

Server info
Omitted IPs.
```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 12b16df3
version = 1.8.4
consul:
acl = enabled
bootstrap = false
known_datacenters = 2
leader = false
leader_addr = [2001:...:406a]:8300
server = true
raft:
applied_index = 140108
commit_index = 140108
fsm_pending = 0
last_contact = 34.443094ms
last_log_index = 140108
last_log_term = 4
last_snapshot_index = 131127
last_snapshot_term = 4
latest_configuration = [...]
latest_configuration_index = 0
num_peers = 4
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Follower
term = 4
runtime:
arch = amd64
cpu_count = 2
goroutines = 105
max_procs = 2
os = linux
version = go1.14.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 3
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 5509
members = 9
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 2018
members = 10
query_queue = 0
query_time = 1
```

### Operating system and Environment details

Both the servers and the client is running on CentOS 7 x86_64. And both have `enable_key_list_policy` set to true.