chef_acl resource

Hmm.  The server will reject non-standard permissions, so my inclination is to say no sanity checking so that permissions can be added to the system without modifying the resource ... but :all creates a wrinkle.

If the system is extended to add a new permission, I'm cool with this working:

```ruby
chef_acl 'nodes/x' do
  rights :list, :users => 'jkeiser'
end
```

But then the user should be justified in assuming that this will include :list:
```ruby
chef_acl 'nodes/x' do
  rights :all, :users => 'jkeiser'
end
```

If we can find a way to satisfy that constraint (the current code does not, but perhaps listing the current ACL's keys will be enough), I'd like to leave validation to the server.