First pass at DSL additions for chef-client audit mode

@mcquin @sersut 
I wanted `controls` to only be available when inside a `control_group`.  I originally started by adding a singleton method to the Recipe, and then removing it before exiting the `control_group` block.  But I'm happier with my nil check below.  Any disagreement?