Initial rules and hardening for logon-related controls

[ghexp]

@aaronlippold, FWIW, I think the current inspec docs still say that singular 'it' is valid along with 'its' but the vanilla build choked (and the hardened was fine?) on the use of the singular. I haven't dug into it to diagnose, but it fixed the build when changing that.