New content on assessing cloud security

Based on new guidance from CESG, reviewed by various people in GDS.
The guidance is in alpha but it's already proving useful in a number
of conversations. Notes here as a pointer to the guidance should be
reasonably unchanging as the guidance evolves.
be specific about ownership of cloud controls matrix
Consistent markdown usage
Merge pull request #361 from alphagov/cloud-security

New content on assessing cloud security