dynamic: "create thread bypassing process freeze" FPs

I'm seeing many FPs for _create thread bypassing process freeze_ for capa dynamic anlaysis of CAPE sandbox, e.g.:
```
NtCreateThreadEx(
ThreadHandle=0x3f8,
ProcessHandle=0xffffffff,
StartAddress=0x100100,
Parameter=0x40,
CreateFlags=0x1,
ThreadId=0x1df8,
ProcessId=0x1a70,
Module="example.exe",
) -> 0x0
```

capa is detecting `0x40` constant passed via _Parameter_ but we only want to match if it is passed via _CreateFlags_.

Start by locating the capa dynamic-analysis rule for “create thread bypassing process freeze” and inspect how the NtCreateThreadEx arguments are matched. Reproduce the shown call, then verify that a match requires 0x40 in CreateFlags rather than Parameter and that the reported false positive no longer matches.

Written by the indexing model from the issue text.