Add serverspec types and matchers.

@tyler-ball there's some fine-tuning to do, but this gets the serverspec stuff we need into the audits.
Technically these are not development dependencies anymore. I vote to make them core dependencies.