feat!: rewrite android maps utils - #1658

Coverage reporting on `library` was already producing an all-zero
report on main before this branch touched anything (reproduced on a
clean main worktree): the report only contained the untested Java
`collections` classes, and every tested Kotlin class (PolyUtil,
MathUtil, SphericalUtil, StreetViewUtils, AttributionIdInitializer)
was silently absent.

Root cause: com.mxalbert.gradle.jacoco-android (last released for
AGP 8.x) auto-detects classDirectories from paths that predate AGP's
built-in Kotlin compiler. AGP 9 now compiles Kotlin into
intermediates/built_in_kotlinc/, which the plugin doesn't know about,
so it silently falls back to javac output only. Overriding
classDirectories on the debug JacocoReport tasks to include both
javac and built_in_kotlinc output fixes this for every module using
the shared PublishingConventionPlugin (verified library, clustering,
data, heatmaps, ui all now report real, non-zero coverage).

Also fixes report.yml, which only ever read
library/build/jacoco/jacoco.xml. Before the module rewrite (#1658)
`library` contained the entire codebase, so that was the whole
project's coverage; after the split into clustering/data/heatmaps/ui,
report.yml was never updated, so "Overall Project" reflected ~2% of
the codebase. Added the other four modules' jacoco.xml to the report
paths. Combined coverage is ~37.5%, comfortably above the existing
26% floor, so no threshold changes needed.

…1740)

* build(deps): update dependency versions and Gradle wrapper

Bump Kotlin, Ktor, Material, kotlinx-serialization, Navigation SDK,
UiAutomator, Lint, AGP, and the Maven Publish plugin to their latest
stable releases. AGP 9.3.1 requires Gradle >= 9.5.0, so the wrapper is
regenerated (via `gradlew wrapper`) to 9.6.1.

xmlutil serialization is left pinned at 0.91.3: 1.0.0 restructured the
XML {} config DSL and breaks GpxParser/KmlParser, which needs a
separate migration.

* build(deps): bump GitHub Actions to latest major versions

Bump actions/checkout to v7 (and align release-rc.yml, which was
still on v5), actions/setup-go to v7, actions/setup-python to v7,
peter-evans/create-pull-request to v8, and madrapps/jacoco-report to
v1.8.0.

* fix(ci): resolve zizmor security findings and lint JDK crash

zizmor (required check) was failing on two mandatory findings:
- unpinned-uses: pin every third-party action in the touched
  workflows to a full commit SHA (with the resolved version as a
  trailing comment) instead of a mutable tag.
- template-injection: release-rc.yml interpolated the workflow_dispatch
  `branch` input directly into a `run:` shell script
  (`git push origin "${{ inputs.branch }}"`), which is a shell
  injection vector. Routed it through a BRANCH env var instead,
  matching how VERSION is already handled in the same job.

Separately, `lintDebug`/`lintStandardDebug` were failing with
`NoSuchMethodError: java.util.List.removeLast()` inside
BidirectionalTextDetector. Reproduced locally: `lint` 32.3.1 (pulled
in by the AGP 9.3.1 bump) now needs JDK 21 to run, but test.yml,
report.yml, docs.yml, and lint-report.yml were still provisioning
JDK 17. Bumped those to JDK 21 (publish.yml already used 21). This is
purely the JDK Gradle itself runs on; the project's own Java
toolchain target is unaffected.

* fix(ci): scope down default GITHUB_TOKEN permissions

zizmor scores its excessive-permissions finding as Medium severity,
which independently fails the required check regardless of the
mandatory-checks list. docs.yml, lint-report.yml, and publish.yml had
no permissions: block, so they inherited the org/repo default (broad)
token scope even though none of their steps need it:
- docs.yml and publish.yml only read the repo via checkout and use a
  separate PAT (SYNCED_GITHUB_TOKEN_REPO) for anything that writes,
  so contents: read is sufficient.
- lint-report.yml additionally uploads SARIF via
  github/codeql-action/upload-sarif, which needs security-events:
  write.

* fix(build): restore real JaCoCo coverage for Kotlin sources

Coverage reporting on `library` was already producing an all-zero
report on main before this branch touched anything (reproduced on a
clean main worktree): the report only contained the untested Java
`collections` classes, and every tested Kotlin class (PolyUtil,
MathUtil, SphericalUtil, StreetViewUtils, AttributionIdInitializer)
was silently absent.

Root cause: com.mxalbert.gradle.jacoco-android (last released for
AGP 8.x) auto-detects classDirectories from paths that predate AGP's
built-in Kotlin compiler. AGP 9 now compiles Kotlin into
intermediates/built_in_kotlinc/, which the plugin doesn't know about,
so it silently falls back to javac output only. Overriding
classDirectories on the debug JacocoReport tasks to include both
javac and built_in_kotlinc output fixes this for every module using
the shared PublishingConventionPlugin (verified library, clustering,
data, heatmaps, ui all now report real, non-zero coverage).

Also fixes report.yml, which only ever read
library/build/jacoco/jacoco.xml. Before the module rewrite (#1658)
`library` contained the entire codebase, so that was the whole
project's coverage; after the split into clustering/data/heatmaps/ui,
report.yml was never updated, so "Overall Project" reflected ~2% of
the codebase. Added the other four modules' jacoco.xml to the report
paths. Combined coverage is ~37.5%, comfortably above the existing
26% floor, so no threshold changes needed.