add rules for accepting recovery_authentication_enabled and external_authentication_uid to chef_user