fix: restore API TLS verification

[shameondev]

Outcome

Restores the platform trust chain and hostname verification for every Android SDK API request. The previous client installed a trust-all X509 manager and an always-true hostname verifier.

Changes

• remove the custom trust-all socket factory
• remove the permissive hostname verifier
• rely on OkHttp platform TLS defaults, including for HTTPS proxy URLs
• add a regression test proving a mismatched hostname is rejected

Verification

• git diff --check
• focused Gradle test is included; local execution is unavailable because this workspace has no Java runtime, so CI is the executable evidence

This is independent from the Remote Config targeting rollout and should be released as a security prerequisite.