Database changes

* Changed `owner` to `contact`
* Added `reference_url`
* Added `Control#principal_assessor` and `#secondary_assessor`
* Added `notes` where missing
* Removed `Program#scope` and `#organization`
* Added `Standard` -- new Directive subtype