Explore a way of better defining the auto-run attestors

[ChaosInTheCRD]

At the moment, the material, product, and command attestors always run. This isn't completely clear from the documentation and CLI --help flag output.

There have also been some previous discussions about the "always on" attestors #277, so this issue is here as a reminder to have a quick look at all this to make everything a bit more clear.