capabilities: only log "real" matched rules, not derived count

[williballenthin]

When emitting log message, show the number of "real" rule matches, ignoring any of the derived subscope rule matches, which account for most matches.

Checklist

• [x] No CHANGELOG update needed
• [x] No new tests needed
• [x] No documentation update needed