Replace the lenient testACLError handler (t.Logf on mismatch) with
strict validation matching the grant error handler pattern:
- Extract assertACLErrorContains helper with progressive fallbacks:
direct match, mapped equivalent, key-part extraction, then t.Errorf
- Convert HeadscaleDiffers from t.Logf to t.Skipf for visibility
- Add aclErrorMessageMap for known wording differences (empty for now)
All 16 ACL error golden files pass with the strict handler.
Updates #3157
Kristoffer Dalby
3065b45310