YARA classification rules

[nazywam]

Reference: #25

It could be useful to allow the user to insert their own classification rules using YARA rules.

The kind, platform, type results would be passed via meta arguments in the rule itself, e.g.:

rule pe_files
{
    meta:
        description = "classifies incoming windows executables"
        kind = "runnable"
        platform = "win32"
        type = "exe"
    strings:
        $mz = "MZ"
    condition:
        $mz at 0 and uint32(uint32(0x3C)) == 0x4550
}

[xorhex]

I like the idea of extending karton-classifier using YARA rules versus modifying the karton-classifier code directly.