enable matching on namespaces

in order to detect that a category of rules match, without hardcoding all the options, we’d like to be able to write statements that specify that a namespace must much. for example, a statement like match: anti-analysis/packer would match if any rule with this namespace (prefix) also matches.

we can currently write rules that contain statements like match: writes to TCP socket to indicate the rule with name writes to TCP socket must match for the parent rule to match. today, if we wanted to specify “packed AND writes to TCP socket” we’d have to hardcode all the packer rules in a large AND block, which is a point of maintenance when new packer rules are added.

i propose extending the match statement to also match namespaces. because namespaces and rule names are typically formatted differently (kebab-case with slashes vs human readable sentence fragments) they should rarely/never overlap.

this supports #390

[williballenthin]

im just padding my stats here.

[williballenthin]

already documented, too. closing issue as already complete.