Add a way for a rule to exclude resources

[lhitchon]

Rules can be scoped to a specific ResourceType which can be "*" for all resources.
They can also be scoped to a list of ResourceTypes
It would be nice to have a way to specify "all resources except for this list"
This is more future-proof than explicitly listing all known resources in the ResourceTypes attribute.

Some typical use cases:
Tagging strategies for AWS resources - list resources types that do not support tagging
Metadata - list resource types that do not require certain metadata attributes