Track control assessments more clearly

You can now leave applicability and control status unset when you add a new Control. This will make it easier to see which controls have actually been assessed, and you will be able to identify gaps more accurately.