How can I prevent a client from being accepted by the cluster as a server?

#### Overview of the Issue

When a client agent turn himself into a server, he can still join the cluster.

Some informations
- the client cannot modify the cluster (seems normal)
- the client cannot vote (seems normal)
- the client can see other members
- other servers see the client as a server

#### Reproduction Steps

Checkout & run this [repository](https://github.com/alexandre-jannotta/consul/tree/bug-9721)

Steps to reproduce this issue:

- Startup servers

```Bash
docker-compose up -d server-1 server-2 server-3
```

- Wait some time for server initialisation
- Startup client

```Bash
sleep 30
docker-compose up -d client-1
```

- Check members

```Bash
docker-compose exec server-1 consul members

# Output
Node Address Status Type Build Protocol DC Segment
server-1 172.29.0.2:8301 alive server 1.9.3 2 paris
server-2 172.29.0.3:8301 alive server 1.9.3 2 paris
server-3 172.29.0.4:8301 alive server 1.9.3 2 paris
client-1 172.29.0.6:8301 alive client 1.9.3 2 paris
```
- Startup the client turned into a server

```Bash
docker-compose up -d client-2
```

- Check members

```Bash
docker-compose exec server-1 consul members

# Output
client-2 172.29.0.7:8301 alive server 1.9.3 2 paris # <=== WTF is he doing here !!
server-1 172.29.0.2:8301 alive server 1.9.3 2 paris
server-2 172.29.0.3:8301 alive server 1.9.3 2 paris
server-3 172.29.0.4:8301 alive server 1.9.3 2 paris
client-1 172.29.0.6:8301 alive client 1.9.3 2 paris
```

```Bash
docker-compose exec client-2 consul members

# Output
Node Address Status Type Build Protocol DC Segment
client-2 172.29.0.7:8301 alive server 1.9.3 2 paris
server-1 172.29.0.2:8301 alive server 1.9.3 2 paris
server-2 172.29.0.3:8301 alive server 1.9.3 2 paris
server-3 172.29.0.4:8301 alive server 1.9.3 2 paris
client-1 172.29.0.6:8301 alive client 1.9.3 2 paris

# WoW !! He can see everyone !
```

### Consul info for both Client and Server

Client turned into server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = f55da930
version = 1.9.3
consul:
acl = disabled
bootstrap = false
known_datacenters = 2
leader = false
leader_addr =
server = true
raft:
applied_index = 0
commit_index = 0
fsm_pending = 0
last_contact = never
last_log_index = 0
last_log_term = 0
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = []
latest_configuration_index = 0
num_peers = 0
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Follower
term = 0
runtime:
arch = amd64
cpu_count = 8
goroutines = 74
max_procs = 8
os = linux
version = go1.15.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 10
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 223
members = 3
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 186
members = 6
query_queue = 0
query_time = 1
```

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = f55da930
version = 1.9.3
consul:
acl = enabled
bootstrap = false
known_datacenters = 2
leader = false
leader_addr = 172.18.0.5:8300
server = true
raft:
applied_index = 3223
commit_index = 3223
fsm_pending = 0
last_contact = 996.9µs
last_log_index = 3223
last_log_term = 92
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{Suffrage:Voter ID:294eadc1-9a10-93a7-1c17-39f33aa1eb1d Address:172.18.0.6:8300} {Suffrage:Voter ID:b502676e-39c6-928e-0293-d3599892115c Address:172.18.0.5:8300} {Suffrage:Voter ID:07ba5408-0140-d11b-5568-a6d77024230f Address:172.18.0.2:8300}]
latest_configuration_index = 0
num_peers = 2
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Follower
term = 92
runtime:
arch = amd64
cpu_count = 8
goroutines = 102
max_procs = 8
os = linux
version = go1.15.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 9
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 238
members = 4
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 186
members = 6
query_queue = 0
query_time = 1
```

Reproduce the behavior with the linked bug-9721 repository using the provided docker-compose commands, then compare the client and server Consul info and members output. Trace how the client configured as a server joins cluster membership; done means a client cannot be accepted or reported as a server, with regression coverage for the reproduction.

Written by the indexing model from the issue text.