yara: add test

Closes #28340.

Signed-off-by: Brett Koonce <koonce@gmail.com>