dotnet: detect large switch statements towards identifying flattened .NET code

The CIL [`Switch` instruction](https://learn.microsoft.com/en-us/dotnet/api/system.reflection.emit.opcodes.switch?view=net-8.0#remarks) encodes the number of cases directly in the instruction so we can detect large switch statements. We often see large switch statements used for control flow flattening (CFF) so this could be a way for capa to detect obfuscated .NET code.

Tasks:
- [ ] research common .NET CFF techniques to determine prevalence of large switch statements (vs. large `if-else` statements, etc.) and to determine a reliable switch case count threshold that indicates flattened .NET code
- [ ] add a new `characteristic` feature e.g. `characteristic('contains flattened code')`

Start with the linked CIL Switch instruction documentation and research common .NET control-flow-flattening techniques. Determine whether large switch statements are prevalent and establish a reliable case-count threshold; done means adding the proposed characteristic feature for flattened code.

Written by the indexing model from the issue text.