test(android): cover certificate transparency enforcement

[yschimke]

Summary

• add deterministic Android Certificate Transparency enforcement and opt-out controls against the host-side TLS fixture
• exercise Android 16 explicit CT opt-in and Android 17/API 37 default CT enforcement with API-qualified network security configs
• add API 36 to the scheduled emulator matrix while retaining API 37.1 on every push and pull request

OkHttp comparison review

The proposed upstream test uses no-sct.badssl.com, whose certificate expired on 2025-12-22. It also accepts any SSL failure on API 37 as proof of CT and swallows every IOException below API 37. Those behaviors allow expiry, trust, hostname, protocol, or network failures to pass as CT results. This testbed coverage instead uses the same locally controlled unlogged certificate for an opt-out success control and an enforced failure, then requires Conscrypt's CT-policy error.

Verification

• :android-ech:compileDebugAndroidTestKotlin
• :android-ech:processDebugManifest and :android-ech:processDebugAndroidTestManifest
• :android-ech:lintDebug
• :android-ech:checkPublicApiOnly
• :ech-fixture:compileKotlin
• bash -n android-ech/run-ech-test.sh
• XML validation and git diff --check