grapheneos: replace bluetooth key via key mapping

Otherwise, the `ReplaceCerts` function in `sign_target_files_apks.py`
doesn't replace the `bluetooth` cert in the `*mac_permissions.xml`
files, resulting in the SELinux metadata being set incorrectly in the
zygote fork invocation.

Author: cyclic-pentane

flavors/grapheneos/default.nix

@@ -171,15 +171,16 @@
             (lib.mkIf (lib.versionAtLeast config.grapheneos.release "2026021200") {
               "build/make/target/product/security/sdk_sandbox" = "${config.device}/sdk_sandbox";
               "build/make/target/product/security/nfc" = "${config.device}/nfc";
+              "build/make/target/product/security/bluetooth" = "${config.device}/bluetooth";
             })
           ];
 
           # Extra packages that should use releasekey
           extraApks = {
             "OsuLogin.apk" = "${config.device}/releasekey";
             "ServiceWifiResources.apk" = "${config.device}/releasekey";
+            "Bluetooth.apk" = "${config.device}/bluetooth";
             "com.android.appsearch.apk.apk" = "${config.device}/releasekey";
-            "Bluetooth.apk" = "${config.device}/releasekey";
             "HealthConnectBackupRestore.apk" = "${config.device}/releasekey";
             "HealthConnectController.apk" = "${config.device}/releasekey";
             "FederatedCompute.apk" = "${config.device}/releasekey";