Restore certificate validation for cached HTTP clients

[jpantonow]

Summary

Affects OkHttpClientModuleKt.setupSsl in app/src/main/java/me/ash/reader/infrastructure/di/OkHttpClientModule.kt.

I found that cachingHttpClient defaulted trustAllCerts to true, causing the default client path to install an app-defined trust manager and an always-accepting hostname verifier. Default connections should validate certificates and hostnames rather than accepting every chain.

I changed the default to false, restoring platform validation for callers that do not explicitly request trust-all behavior. The existing trustAllCerts=true path and client-certificate setup remain unchanged.

Servers whose certificate the system does not trust (self-signed or from a private CA), accepted silently until now, are rejected. The added network security config lets their users install that CA on the device; without it Android ignores user-installed CAs for apps targeting API 24 or later.

I found this while running the app under RVSec, a runtime-verification tool that watches the app's calls to the Java cryptography and TLS APIs and checks each sequence of calls against usage rules written in CrySL. SSLContextSpec is the rule this code did not satisfy.

How was this tested?

• No automated test was added in this change
• Project compiles successfully (:app:assembleFdroidDebug)

---

I'm an undergraduate Computer Engineering student at the University of Brasília (UnB); this contribution is part of a research project on the analysis of Android apps, and I'm happy to adjust it to match the project's conventions.