Add the references to the selected rules

Change Control.add_references() to iterate over the selected rules, not
the listed rules.

There can be differences on the rules in 'selected' and 'rules'.
When the Control is resolved, the final list of selected rules is in
'selected'.
This is particularly more evident when we are importing other controls.

ssg/controls.py

@@ -177,7 +177,7 @@ def represent_as_dict(self):
         return data
 
     def add_references(self, reference_type, rules):
-        for selection in self.rules:
+        for selection in self.selections:
             if "=" in selection:
                 continue
             rule = rules.get(selection)