CapabilityRule get_clean(): return one rule per capability

... instead of keeping multiple capabilities in a single rule (which is not really clean).

Also adjust the expected result for multi-capability rules in the tests.