DinoMaps for Android 1.1.12: security audit fixes

Fixed:
- Android Auto service accepted any host (an installed app could act as the car and receive position, Home/Work and the route). Release builds now admit Google's Android Auto hosts only.
- geo: links with NaN or out-of-range coordinates crashed the app.
- Backups were on: trips and saved places could leave the phone via cloud or device transfer. Off now.
- Update download: file name was taken from the server, URL/size/checksum were optional. Now a fixed name, HTTPS on the own host, size and SHA-256 required, 300 MB cap.
- Voice-pack zip extraction: containment check could be fooled by a name prefix, no size limits. Fixed with budgets.
- Manifest URLs and routing-graph names are validated; downloads only from the own host.
- Spoken lines and the map viewport no longer appear in release logs; cleartext HTTP blocked on every Android version.
- Theme links capped at 50 themes, duplicates reused.

Build: Guava raised to 33.7.2 (CVE-2026-102554, via androidx.car.app). Android Lint (security rules fatal), Trivy dependency scan on the pinned lockfile, signature check for tagged builds. Details in SECURITY.md and the iOS repository's docs/SECURITY-AUDIT-2026-10-31.md.