Confusing error message with SPIFFE verification.

I am currently getting the following error when connect verifies the SPIFFE URI:
```
peer certificate mismatch got spiffe://36ca82ca-9d82-cf7a-3ac8-3ac58e297d57.consul/ns/default/dc/dc1/svc/uuid-api, want spiffe:///ns/default/dc/dc1/svc/backend1
```
While this is absolutely correct and the two services do indeed not match, I think the expected URI should include the interpolated hostname (trust domain) to prevent unnecessary confusion. This is probably just a matter of moving https://github.com/hashicorp/consul/blob/b678eabbf50eff64603c30ae55f752985b0d9e91/connect/tls.go#L182 down and use `expectURI` to construct the string instead.