use "span of calls" scope

[williballenthin]

like #972
supporting mandiant/capa#2532

sed -i 's/dynamic: thread/dynamic: sequence/g' (rg -l 'static: function' (rg -l 'dynamic: thread'))
sed -i 's/dynamic: thread/dynamic: sequence/g' (rg -l 'static: basic block' (rg -l 'dynamic: thread'))

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: span of calls

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

Suggested change

	dynamic: span of calls
	dynamic: call

[mike-hunhoff]

I spot checked ~30 of these rules and the changes look reasonable to me.

Generally, we need to asses the existing capa rules (I don't recommend doing it in this PR) for opportunities to tighten up the scopes (I've left comments on a few of these that I noticed here) to reduce FP (and improve performance??). I imagine this would be implemented as a lint that verifies the scopes specified for a new rule are the smallest possible, accounting for match features and whatnot. We should also add a lint that verifies scopes align correctly for match features, iirc we've encountered this in the past, and I'm sure it'll only be more of an issue as we've added new scopes.