fix(ffi): Using rustls in Android

[jmartinesp]

It turns out on Android, rustls needs a custom setup and adding the rustls-platform-verifier-android library that's not available on Maven.

Then, from the Android clients we'd need to call some exposed JNI function so we can provide a JVM context from where Rust can take the Application component and access its contents to read its credentials storage. Thanks to some tricks we can use libloading to simulate this call from Rust itself and properly initialise the platform verifier.

Note self-signed certificates will no longer work with these changes on Android, and providing them in ClientBuilder::add_root_certificates will make most requests fail. This can be handled separately.

• I've documented the public API Changes in the appropriate CHANGELOG.md files.
• This PR was made with the help of AI.

Signed-off-by:

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.82%. Comparing base (60ce062) to head (c49ad73).
⚠️ Report is 8 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6306   +/-   ##
=======================================
  Coverage   89.81%   89.82%           
=======================================
  Files         376      376           
  Lines      102447   102447           
  Branches   102447   102447           
=======================================
+ Hits        92017    92019    +2     
+ Misses       6850     6843    -7     
- Partials     3580     3585    +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 50 untouched benchmarks

---

_{Comparing fix/rustls-with-android (c49ad73) with main (60ce062)}

[jmartinesp]

Since we have access to the JavaVM now, it seems like it's recommended to use this method to attach JVM threads to Rust ones according to uniffi.

[stefanceriu]

Thank you but no thank you, you don't want me reviewing this 😅

[poljar]

Ok, I think all of this is making sense to me. Obviously I trust you that you checked that this actually works.

Note self-signed certificates will no longer work with these changes on Android, and providing them in ClientBuilder::add_root_certificates will make most requests fail. This can be handled separately.

This will be mostly done on the EXA side? I remember pushing a PR there which used this method to add custom certs, and now we can just use the system cert store for this, right?

[jmartinesp]

Obviously I trust you that you checked that this actually works.

Now you made me anxious and I'll have to quadruple-check it!

This will be mostly done on the EXA side? I remember pushing a PR there which used this method to add custom certs, and now we can just use the system cert store for this, right?

Yeah, I think we'll just stop providing these custom certs manually in ClientBuilder.