sync(chunk 2b): CalDAV discovery and auth protocol

New :caldav module — MIT, plain JVM, api-depends on :dav. Separate from the
vendored MPL tree so the licences stay unmixed, and so "no Android types" is a
compile-time guarantee rather than a discipline. Chunk 2 split again: the
Android account layer (Keystore, AccountManager, Custom Tabs, account-add UI)
is 2c, with different verification and an on-device review.

- ServiceDiscovery: the RFC 6764 ladder. SRV priority/weight, TXT path=,
  non-443 ports, "." targets, well-known then root.
- CollectionClassifier: the two filters that are inversions of the obvious
  rule. An absent or empty supported-calendar-component-set means "supports
  everything", and classification is a positive test for CALDAV:calendar on an
  unordered set — excluding schedule-outbox would drop SOGo's main calendar.
- CalDavDiscovery: OPTIONS gate, principal, every home set, Depth-1 by name.
  A failing home set does not fail the account, and every home set failing is
  reported as an error rather than as an account with no lists.
- NextcloudLoginFlow: POST not GET, a User-Agent the user can recognise when
  revoking, 404-means-pending only, both URLs origin-checked, host mismatch
  carried rather than refused (reverse proxies are ordinary).
- PreemptiveBasicInterceptor, ServerQuirks.

dnsjava 3.6.3 (BSD-3) added: Android's DnsResolver is callback-only and cannot
do the TXT path lookup, and JNDI's DNS provider does not exist on Android.
Behind an interface, so every trap is tested with a fake and no network.

:dav gains change 6 — <D:unauthenticated/> is parsed rather than inferred from
a null href, which also fires on a merely non-conformant empty element.

52 tests here, 78 in :dav. SYNC.md's live-probed trap table is executable now.

dav/PROVENANCE.md

@@ -107,6 +107,20 @@ through its `Calendar`, and any caller could `setTimeZone` on it and undo change
 for everyone else. It is now private and built per call. Nothing else in the tree
 referenced it.
 
+### 6. `<D:unauthenticated/>` is parsed instead of inferred
+
+`CurrentUserPrincipal.Factory` read only the `<href>` child, so an
+unauthenticated body (RFC 5397 §3 — a **200** whose content means the request was
+not authenticated) arrived as "property present, href null" — identical to a
+conformant-but-empty element, and to a server that omits the property entirely.
+A caller inferring rejection from the null href therefore also fires on merely
+non-conformant servers, and on a request that carried no credential at all.
+
+The factory now makes one pass over both children (`XmlUtils.processTag` consumes
+to the end tag and so cannot be called twice) and reports `unauthenticated`
+explicitly. Without it, a rejected credential is indistinguishable from a
+successful discovery that found nothing.
+
 ---
 
 ## Build integration