sync(chunk 2a): vendor dav4jvm 2.2.1 as :dav

JitPack-only publishing conflicts with FAIL_ON_PROJECT_REPOS, artifacts are
unsigned and not immutable, and upstream shipped two breaking majors 19 days
apart. 2.2.1 is the last OkHttp release: 3.0.0 moved to Ktor and 4.x needs
Java 21, and SYNC.md's whole auth section is written in OkHttp terms, so 4.x
would have invalidated it. A plain JVM module, not an Android library — the
tree has no Android imports and keeping it that way keeps the floret-kit
extraction a file move.

Four changes from upstream, all in dav/PROVENANCE.md:
- commons-lang3 dropped (one import, one call). The replacement requires the
  whole string to be consumed, as DateUtils did: pattern 1 ends in a literal
  'GMT', so SimpleDateFormat would match "...GMT+02:00" as a prefix and throw
  the offset away.
- HTTP dates were parsed and formatted in the device's local zone — the GMT in
  the format string is a quoted literal and timeZone was never set, so every
  getlastmodified was out by the local UTC offset. Upstream tests dates
  nowhere. The formatter is also no longer shared and mutable.
- dav4jvm#209: permanent redirects now reach the caller via
  DavResource.permanentLocation, cleared per request so it never describes an
  earlier one.
- xpp3 is compileOnly; Android supplies org.xmlpull.v1.

SYNC.md's other claimed defect, "does not follow 303", is not true of 2.2.1 —
pinned by a test rather than removed from the notes.

CI names :dav:test explicitly; testDebugUnitTest is Android-only and would
have run none of the vendored suite. lintDebug added to the per-chunk checks
after it caught a literal byte-order mark left by chunk 1.

gradle/libs.versions.toml

@@ -33,6 +33,16 @@ androidxTestRules = "1.7.0"
 # Glance: 1.1.1 is the latest stable (1.2.0 is still rc, 1.3.0 alpha).
 glance = "1.1.1"
 
+# --- :dav (vendored dav4jvm) -------------------------------------------------
+# dav4jvm 2.2.1 is the last OkHttp release; 3.0.0 deleted the OkHttp package for
+# Ktor and 4.x additionally requires Java 21 bytecode, which we do not target.
+# See dav/PROVENANCE.md. OkHttp 4.12.0 is what the vendored tree was written
+# against and what DAVx5 ships.
+okhttp = "4.12.0"
+# org.xmlpull.v1 ships in the Android framework, so xpp3 is compileOnly +
+# testImplementation and never reaches the APK.
+xpp3 = "1.1.6"
+
 # --- :provider (vendored dmfs task provider) ---------------------------------
 # Versions the upstream 1.4.2 source was written against. These are its runtime
 # dependencies, not ours — nothing above the data layer touches them, and they
@@ -125,6 +135,11 @@ androidx-glance-material3 = { group = "androidx.glance", name = "glance-material
 # Android tests - GrantPermissionRule
 androidx-test-rules = { group = "androidx.test", name = "rules", version.ref = "androidxTestRules" }
 
+# :dav — vendored dav4jvm (see dav/PROVENANCE.md)
+okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhttp" }
+okhttp-mockwebserver = { group = "com.squareup.okhttp3", name = "mockwebserver", version.ref = "okhttp" }
+xpp3 = { group = "org.ogce", name = "xpp3", version.ref = "xpp3" }
+
 # :provider — vendored dmfs task provider (see provider/PROVENANCE.md)
 dmfs-jems = { group = "org.dmfs", name = "jems", version.ref = "dmfsJems" }
 dmfs-jems-testing = { group = "org.dmfs", name = "jems-testing", version.ref = "dmfsJems" }