Improvement to bypass-uac-via-token-manipulation

The rule [`bypass UAC via token manipulation`](https://github.com/mandiant/capa-rules/blob/master/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml) currently looks for one process typically abused by UAC bypass techniques (`wusa.exe`). It also assumes the process will be run using `ShellExecuteExW`.

Two improvements could be considered:
- Look for APIs associated with process enumeration (e.g. `EnumProcesses`).
- Look for a wider selection of processes (e.g. [this list](https://gist.github.com/dezhub/c0fee68d1e06657a45ec39365362fca7#file-uacbypasstokenmanipulation-py-L365)).

Start with host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml and review its current wusa.exe and ShellExecuteExW conditions. Compare the proposed EnumProcesses API coverage and the linked process list, then define the expanded rule scope. Done means the rule recognizes the intended process-enumeration and wider process patterns without depending only on wusa.exe or ShellExecuteExW.

Written by the indexing model from the issue text.