Proposal: All CCC Requirements must be machine testable

## Bug Report

Currently, we have requirements like:

```
controls:
- id: CCC.Core.CN03
title: Implement Multi-factor Authentication (MFA) for Access
objective: |
Ensure that all sensitive activities require two or more identity
factors during authentication to prevent unauthorized access.
assessment-requirements:
- id: CCC.Core.CN03.AR01
text: |
When an entity attempts to modify the service through a user
interface, the authentication process MUST require multiple
identifying factors for authentication.
applicability:
- tlp-clear
- tlp-green
- tlp-amber
- tlp-red
recommendation: ""
```

This is from the Core catalog.

However, it's not possible to write an automated test covering MFA.

This means that when you get your CFI results, you get a number of things:

- PASSED tests
- FAILED tests
- UNTESTABLE tests

I would like us to remove this latter category from CCC, as it's just "noise" in the test report and reduces the value of what we're doing. Also, it will make a conformance process more difficult and manual.

I think the value of what we are doing here is a programmatic layer for asserting controls.

Perhaps this means we need some way of including a list of "rejected controls" (and our reasoning) somewhere in CCC also?