add coverage for process manipulation via WMI Win32_Process

> The Win32_Process WMI class represents a process on an operating system.

https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/terminate-method-in-class-win32-process

Review the linked Microsoft documentation for the Win32_Process Create and Terminate methods. Determine how capa-rules represents process manipulation through WMI, then add coverage for those behaviors and verify that the resulting rules recognize them.

Written by the indexing model from the issue text.