Suspected members of the Somali militant group al-Shabab have killed at least 28 people in an attack on a bus in northern Kenya, officials say.