chef_acl resource

What about:

```ruby
thing do 
  complete true
  remove_rights :read, :users => 'xx', :groups => 'yy'
end
```

In case someone wants to just remove the rights only? (I can't say whether or not this 100% fits the 'complete' model use case as only specifying remove is arguably not enough to be "complete" but I can see people doing this...)