PoC Event-based malware check

[woodruffw]

Once #7196 has settled, we'll need an initial (non-stub) malware check for proofing the event-based check system.

The current proposal: our PoC check will be based on YARA, and will include patterns for detecting unusual/malicious patterns in setup.py files. Examples of unusual and malicious patterns:

• Attempting to spawn or invoke processes: os.system, os.exec*, os.posix_spawn*, etc.
• Attempting to perform network requests
• Attempting to call deserialization routines frequently used for ACE and/or obfuscation

See #7096.

[ewjoachim]

(Just to save someone a google search: YARA probably refers to https://github.com/VirusTotal/yara )

[woodruffw]

(Just to save someone a google search: YARA probably refers to https://github.com/VirusTotal/yara )

Yep, that's the one.

[woodruffw]

Began work on this in #7249.

[woodruffw]

Merged; will close when this hits master.