build(deps): update dependencies, Gradle wrapper, and GitHub Actions - #1740

Bump Kotlin, Ktor, Material, kotlinx-serialization, Navigation SDK,
UiAutomator, Lint, AGP, and the Maven Publish plugin to their latest
stable releases. AGP 9.3.1 requires Gradle >= 9.5.0, so the wrapper is
regenerated (via `gradlew wrapper`) to 9.6.1.

xmlutil serialization is left pinned at 0.91.3: 1.0.0 restructured the
XML {} config DSL and breaks GpxParser/KmlParser, which needs a
separate migration.

zizmor (required check) was failing on two mandatory findings:
- unpinned-uses: pin every third-party action in the touched
  workflows to a full commit SHA (with the resolved version as a
  trailing comment) instead of a mutable tag.
- template-injection: release-rc.yml interpolated the workflow_dispatch
  `branch` input directly into a `run:` shell script
  (`git push origin "${{ inputs.branch }}"`), which is a shell
  injection vector. Routed it through a BRANCH env var instead,
  matching how VERSION is already handled in the same job.

Separately, `lintDebug`/`lintStandardDebug` were failing with
`NoSuchMethodError: java.util.List.removeLast()` inside
BidirectionalTextDetector. Reproduced locally: `lint` 32.3.1 (pulled
in by the AGP 9.3.1 bump) now needs JDK 21 to run, but test.yml,
report.yml, docs.yml, and lint-report.yml were still provisioning
JDK 17. Bumped those to JDK 21 (publish.yml already used 21). This is
purely the JDK Gradle itself runs on; the project's own Java
toolchain target is unaffected.

Coverage reporting on `library` was already producing an all-zero
report on main before this branch touched anything (reproduced on a
clean main worktree): the report only contained the untested Java
`collections` classes, and every tested Kotlin class (PolyUtil,
MathUtil, SphericalUtil, StreetViewUtils, AttributionIdInitializer)
was silently absent.

Root cause: com.mxalbert.gradle.jacoco-android (last released for
AGP 8.x) auto-detects classDirectories from paths that predate AGP's
built-in Kotlin compiler. AGP 9 now compiles Kotlin into
intermediates/built_in_kotlinc/, which the plugin doesn't know about,
so it silently falls back to javac output only. Overriding
classDirectories on the debug JacocoReport tasks to include both
javac and built_in_kotlinc output fixes this for every module using
the shared PublishingConventionPlugin (verified library, clustering,
data, heatmaps, ui all now report real, non-zero coverage).

Also fixes report.yml, which only ever read
library/build/jacoco/jacoco.xml. Before the module rewrite (#1658)
`library` contained the entire codebase, so that was the whole
project's coverage; after the split into clustering/data/heatmaps/ui,
report.yml was never updated, so "Overall Project" reflected ~2% of
the codebase. Added the other four modules' jacoco.xml to the report
paths. Combined coverage is ~37.5%, comfortably above the existing
26% floor, so no threshold changes needed.