Migrate from Cargo-bundled Maven repository to GitHub-hosted Maven artifact repository

[complexspaces]

This PR implements the plan that I outlined last year to redo the Android distribution channels (hopefully for the last time!) with a few improvements for simplicity.

We are switching from shipping AAR builds with Cargo releases to using rustls-platform-verifier-android as solely a version synchronization tool and distributing the AAR via a stateful Maven "local" repository that is going to be hosted in the maven-archive branch of this repository. Gradle will depend on this remote filesystem structure transparently, treating it exactly like a regular Maven package registry.

The main branch of this repository (and any release branches) now hold a maven-metadata-local.xml file that contains the persistent state required for a Maven remote. main is the source of truth for the data and during releases it gets copied into the maven-archive branch to "enable" finding the newly built artifacts. This is also intended to prevent ever running into Git conflicts when switching between the two.

This now means there shouldn't be anymore weird dependencies between the Rust part of this library and the Android part for downstream users who have a split between their Java libraries and actual host applications. Both can fetch from the same remote without any dependency on eachother and the final version of the Android component can be selected by the top-level app.

I tested this plan out in https://github.com/complexspaces/rustls-platform-verifier-android-sandbox originally with 1Password's Android app as the downstream user using the new README code snippets and all. Here's a screenshot of Android Studio showing successful version resolution and downloading of the AAR library:

More PRs follow this one to assemble the rest of the components and then demonstrate preparing for a new release using the updated process and releasing guide:

• Prepare maven-archive branch to host Maven registry and Android artifacts #252 sets up the maven-archive branch that artifacts will be served on in the future. It shares the metadata XML file owned by this branch.
• Prepare 0.2.0 release of Android components and 0.7.1 #253 updates that Maven metadata file and Rust crate versions to setup for a new release that will be made including all these process changes. It demonstrates a bump to the checked in state.
• Publish 0.2.0 Android release to Maven archive branch #254 pulls in the changes from both Prepare maven-archive branch to host Maven registry and Android artifacts #252 and Prepare 0.2.0 release of Android components and 0.7.1 #253 to produce a newly updated Maven archive state that can serve the 0.1.2 release to Gradle clients over the network.

Commit-by-commit review is heavily recommended.

Closes #115, #226

[complexspaces]

Ah I forgot one thing last week: Before this merges I want to test reverting the test-only workaround for CRL fetching failures and confirm the new manifest is working as intended in our CI environment:

rustls-platform-verifier/android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt

Lines 360 to 366 in 027c029

	// LetsEncrypt no longer include OCSP information (as OCSP is being deprecated) which Android is not
	// happy with since it *only* tries OCSP by default. We aren't 100% decided on how to fix this yet for real
	// (see https://github.com/rustls/rustls-platform-verifier/pull/179) so for now we implement an out for
	// tests to allow regular maintenance to proceed.
	if (BuildConfig.TEST && e.reason == CertPathValidatorException.BasicReason.UNSPECIFIED) {
	return VerificationResult(StatusCode.Ok)
	}

[complexspaces]

I confirmed its working locally. With the inline workaround removed and changing the manifest locally to allow no cleartext traffic I get the same error everyone runs into:

Putting the manifest back to its main state allowing cleartext traffic for the CRL endpoints makes all tests pass 🎉

I needed to bump our build tooling versions locally to work with the latest Android Studio as well so I've pushed that up here.

[djc]

The commit history looks a bit messy? IMO the Kotlin formatting/lint stuff should be fixed in the same commit where the version that causes these to pop up is bumped.

It's not clear to me why CI against 48fc34f failed but fixing that by reordering commits might be nice, too.

[complexspaces]

Good point on the commit history 😅. I squashed the Kotlin lint fixes and workaround removal into larger ones since I think neither of those make sense on their own because they are dependent on a bigger change.

I also reordered history to have "fixing builds to make everything work" be before anything that changes Android Studio related things.