At least four people have been killed after a car bomb exploded at a hotel in central Somalia and al-Shabab fighters stormed the building, witnesses say.