stream path rule: filename::$DATA (unnamed default data stream)

> Also, what about filename::$DATA (unnamed default data stream)?

I think we should create a separate rule for this, with a feature like `substring: ":$DATA"`

_Originally posted by @williballenthin in https://github.com/mandiant/capa-rules/pull/718#discussion_r1123073312_

Locate the existing stream path rule and review the pull-request discussion referenced in the issue to understand how comparable rules are structured. Add a separate rule for the unnamed default data stream using the requested `substring: ":$DATA"` feature, and verify that it matches the intended filename::$DATA path.

Written by the indexing model from the issue text.