Audit mode

Alright @opscode/client-engineers, have a look-see.  I'm going to clean up the commit log with an interactive rebase after I'm sure we don't have any branches/PRs pending.

This is the implmentation for https://github.com/opscode/chef-rfc/pull/69
Can we add a comment about the fact that audit related events are currently experimental and are subject to change in the final implementation?