linter: allow capa rules to specify dynamic sandbox trace files for example files

[mike-hunhoff]

No description provided.

[mr-tz]

Since we index all test samples also by filename this actually works already like:

...
examples:
  - 2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4_min_archive.zip

We only have to determine and document what data to list. I'd initially say it's fine to just list the file without any details on the pid, tid, callid, etc.

[mr-tz]

One downside is that the dynamic VMRay test files tend to be relatively large (a few MB to several dozen MB).

[mike-hunhoff]

One downside is that the dynamic VMRay test files tend to be relatively large (a few MB to several dozen MB).

We'd also want to enforce users to leverage our VMRay minify script when adding new VMRay archives.

[mr-tz]

this works, see e.g. mandiant/capa-rules#938