Text this: A Scalable Game-Theoretic Approach for Selecting Security Controls from Standardized Catalogues