capafmt breaks `description` field if namespace contains `features`

### Description

The rule formatter, `capafmt.py`, currently used for ensuring linting of mandiant/capa-rules has a bug that incorrectly indents `description` field from 4 spaces to 6 spaces. This "formatted" YAML is not a valid YAML and is not accepted across any YAML parsers. In other words, the formatter corrupts the "violating" rule.

This appears to be caused by https://github.com/mandiant/capa/blob/f04931d0b351fcdf9ebb0d412793326cd5d97c15/capa/rules/__init__.py#L1377 , where somehow when looking for the `features` field, it mistakenly matched the `namespace` field with the word `features`, and incorrectly applied the `description` bump fix that was originally made to address #263.

This issue was never discovered until now as only 5 rules used `impact/features` under `nursery`, and none of them contained a description field. When creating the PR https://github.com/mandiant/capa-rules/pull/1173, the rule was created with `impacts/features` in mind, as that was also the case for other Defender-related rules under `nursery`. I was later asked to add a `description` field, and these two combinations just so happen to surface this 6-year-old bug.

A proposed fix would be add a newline check so instead of,

```py
features_offset = doc.find("features")
```

Add other anchors to pin the search down, or rewrite the entire fix altogether:

```py
features_offset = doc.find("\n features:")
```

### Steps to Reproduce

1. Create a new rule that uses the namespace `[...]/features` alongside a `description` field for the rule meta.
2. Run capafmt in-place on the newly created rule
3. See the incorrectly placed description field

**Expected behavior:**

`description` field gets formatted properly with correct indentation.

```yml
description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution.
```

**Actual behavior:**

`description` field gets formatted improperly with additional indentation.

```yml
description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution.
```

### Versions

### Additional Information

Start with capa/rules/__init__.py around the capafmt logic that searches for the `features` field; the issue also identifies capafmt.py as the affected formatter. Reproduce the case with a namespace containing `features` and a description field, then run capafmt in-place and verify that the YAML remains valid with the description correctly indented.

Written by the indexing model from the issue text.