consul: check for acceptable service identity on consul tokens

[shoenig]

When registering a job with a service and 'consul.allow_unauthenticated=false',
we scan the given Consul token for an acceptable policy or role with an
acceptable policy, but did not scan for an acceptable service identity (which
is backed by an acceptable virtual policy). This PR updates our consul token
validation to also accept a matching service identity when registering a service
into Consul.

Fixes #15902

[shoenig]

Spot check

nomad.hcl (+ dev mode)

log_level = "INFO"
  
server {
  enabled = true
}

client {
  enabled = true
}

consul {
  token = "c1ef7742-9fdf-13d2-de5c-c292305987fb"
  allow_unauthenticated = false
}

create SI token

consul acl token create -local -service-identity=redis

job with redis service

job "demo" {
  datacenters = ["dc1"]

  group "cache" {
    network {
      port "db" {
        to = 6379
      }
    }
    
    service {
      name = "redis"
      port = "db"
    }

    task "redis" {
      driver = "docker"

      config {
        image          = "redis:7"
        ports          = ["db"]
        auth_soft_fail = true
      }

      resources {
        cpu    = 500
        memory = 256
      }
    }
  }
}

job submit works

nomad job run -consul-token=b8091c16-ee9c-2643-86d7-79a8855ab6d3 demo.nomad
...
  ✓ Deployment "805fa0fa" successful

[gulducat]

nice and clean 👍