Add PPID spoof PoC test sample for capa-rules #1167

[itxsamad1]

Summary

• Adds minimal Windows PE test sample demonstrating full parent PID spoofing flow
• Sample SHA256: 7fc295b013cf773eb71e3de24944a7ca1e876846137cb6c6a758a26bbc1ce4f5
• Used by capa-rules PR feat: strengthen spoof parent PID rule with full PPID spoofing flow capa-rules#1167 (spoof parent PID rule example)

Sample behavior

The binary implements the complete PPID spoofing sequence:

1. InitializeProcThreadAttributeList
2. UpdateProcThreadAttribute with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (0x20000)
3. CreateProcessW with EXTENDED_STARTUPINFO_PRESENT

Test plan

• Verified with capa v9.4.0 against updated rule on branch enhance/spoof-parent-pid-detection
• Rule spoof parent PID matches at function 0x140001000