The Apache ProxyPassRewrite does not rewrite the response bodies received from http://test.example.com, only headers (like redirects to a 404 page and such).
A number of alternatives:
One) Rewrite the internal app to use relative paths instead of absolute. i.e. ../css/style.css instead of /css/style.css
Two) Redeploy the internal app in a the same subdirectory /folder rather than in the root of test.example.com.
Three) One and two are often unlikely to happen... If you're lucky the internal app only uses two or three subdirectories and those are unused on your main site, simply write a bunch of ProxyPass lines:
# Expose Internal App to the internet.
ProxyPass /externalpath/ http://test.example.com/
ProxyPassReverse /externalpath/ http://test.example.com/
# Internal app uses a bunch of absolute paths.
ProxyPass /css/ http://test.example.com/css/
ProxyPassReverse /css/ http://test.example.com/css/
ProxyPass /icons/ http://test.example.com/icons/
ProxyPassReverse /icons/ http://test.example.com/icons/
Four) Create a separate subdomain for the internal app and simply reverse proxy everything:
<VirtualHost *:80>
ServerName app.example.com/
# Expose Internal App to the internet.
ProxyPass / http://test.internal.example.com/
ProxyPassReverse / http://test.internal.example.com/
</VirtualHost>
Five) Sometimes developers are completely clueless and have their applications not only generate absolute URL's but even include the hostname part in their URL's and the resulting HTML code looks like this: <img src=http://test.example.com/icons/logo.png>.
A) You can use combo solution of a split horizon DNS and scenario 4. Both internal and external users use the test.example.com, but your internal DNS points directly to the ip-address of test.example.com's server. For external users the public record for test.example.com points to the ip-address of your public webserver www.example.com and you can then use solution 4.
B) You can actually get apache to to not only proxy requests to test.example.com, but also rewrite the response body before it will be transmitted to your users. (Normally a proxy only rewrites HTTP headers/responses). mod_substitute in apache 2.2. I haven't tested if it stacks well with mod_proxy, but maybe the following works:
<Location /folder/>
ProxyPass http://test.example.com/
ProxyPassReverse http://test.example.com/
AddOutputFilterByType SUBSTITUTE text/html
Substitute "s|test.example.com/|www.example.com/folder/|i"
</Location>
Late edit
Six) Sometimes developers provide special application settings specifically for deployments where the application is behind a reverse proxy. The application can then be configured to generate self referential URL's, with the protocol, the site name and URI path that users are/should be using, rather then the hostname, the protocol and/or the URI the application detects. Expect terms like external URL, site URL. Then you don't need to solve anything in Apache.