New content on assessing cloud security

Based on new guidance from CESG, reviewed by various people in GDS.
The guidance is in alpha but it's already proving useful in a number
of conversations. Notes here as a pointer to the guidance should be
reasonably unchanging as the guidance evolves.