CLI: allow `nomad acl token update` to move a token from client to management

[philrenaud]

Currently the reason this isn't possible is less "it's not allowed" as much as it is "Management tokens cannot have any policies, as a prerequisite, and client tokens must have at least one policy, as a prerequisite, and you cannot bring the number of policies on a client token down to 0"

So, we (could/should) handle something like nomad acl token update -type=management <accessor> by:

1. Just removing any policies (and roles) on that token and saying "okay it's a management token now", or
2. Mandating but allowing the removal of policies/roles at conversion-to-management time with nomad acl token update -type=management -policy="" or something similar