Create a clear recommendation on when to use `at()`

[AndrewPardoe]

Please see the discussion in #1070 for context, also, SL.con.3: Avoid bounds errors.

[johnmcfarlane]

Is it now the case that span::operator[] always bounds checks? (It calls Expects which now branches irrespective of preprocessor macros.

I'm running out of brain cells trying to keep track of all of the discussions in the issues and PRs in this repo and GSL, but are we sure we wish to be imposing unused branches in bug-free code everywhere we're enforcing contracts with GSL -- and, by association, throughout the CCG?