ACL policies allows multiple rules where there should only be one and uses the last one

### Nomad version

```console
$ nomad version
Nomad v1.0.2 (4c1d4fc6a5823ebc8c3e748daec7b4fda3f11037)
```

### Issue

According to the ACL policy [specification](https://learn.hashicorp.com/tutorials/nomad/access-control-policies#acl-policy-specification), only one [`agent`](https://learn.hashicorp.com/tutorials/nomad/access-control-policies#agent-rules) rule is allowed. The actual `Policy` struct also indicates only one `AgentPolicy` should be decoded:

https://github.com/hashicorp/nomad/blob/e9cea770e630fb613e173e643841b09fd5480eed/acl/policy.go#L70-L79

However, an ACL policy with two `agent` rules does not cause an error and is accepted as valid input. Because, in essence, it is valid HCL, but not valid Nomad ACL. The underlying HCLv1 doesn't safely decode the content, and allows the objects to overwrite into the Go object during decoding.

### Reproduction steps

```hcl
agent {
policy = "read"
}

agent {
policy = "write"
}
```

```go
func Parse(r io.Reader, target interface{}) error {
src, err := ioutil.ReadAll(r)
if err != nil {
return fmt.Errorf("failed to read given reader: %w", err)
}

err = hcl.Decode(target, string(src))
if err != nil {
return fmt.Errorf("failed to decode bytes from reader: %w", err)
}
return nil
}

func TestDoubleAgent(t *testing.T) {
path := "testdata/double_agent.hcl"
fh, err := os.Open(path)
require.NoError(t, err)
t.Cleanup(func() {
fh.Close()
})
target := Policy{}
err = Parse(fh, &target)
require.NoError(t, err)
t.Logf("agent policy: %v", target.Agent.Policy)
}
```

```console
$ go test -run TestParseNomad -v
agent policy: write
```

This problem also applies to all other rules where only one should be accepted ( a single struct, not a slice of structs ):
* `agent`
* `node`
* `operator`
* `quota`
* `plugin`

Start in acl/policy.go and inspect the Parse entry point and the TestDoubleAgent reproduction, including testdata/double_agent.hcl. Run go test -run TestParseNomad -v, then cover duplicate agent, node, operator, quota, and plugin rules so invalid policies produce an error instead of silently keeping the last rule.

Written by the indexing model from the issue text.