CI: run new rules against a set of well-known files to demonstrate prevalence

[williballenthin]

shows if a rule is susceptible to obvious FPs or unexpected matches. doesn't need to be a huge scale of samples, just a bit of diversity.

[mr-tz]

using viv/frz files for this is less of an issue than for #423 as we are not testing, but want to get a rough overview of potential rule hits/FPs

[mr-tz]

Current thoughts on what we need to make this practical:

• reasonable collection of samples, with appropriate diversity
  • issue: where to store the files?
  • issue: total file size vs diversity?
• script to generate frz files of directory
  • see capa/features/freeze/__init__.py
• mechanism to update frz files automatically (CI)
  • workflow that regenerates frz files and pushes updates to repository, e.g. tests/data/frz
  • issue: when to generate these?
    • e.g. weekly, on update to code parts, manually
• script that runs (subsets of) rules on frz files
  • group by rule, show matches
  • show overview stats
• run this during rule CI, either during PR or periodically
  • issue: how long does it take to run?