chef_acl resource

Maybe just document the expected results of this, it's not totally obvious without deep diving