sync(chunk 2b): CalDAV discovery and auth protocol

New :caldav module — MIT, plain JVM, api-depends on :dav. Separate from the
vendored MPL tree so the licences stay unmixed, and so "no Android types" is a
compile-time guarantee rather than a discipline. Chunk 2 split again: the
Android account layer (Keystore, AccountManager, Custom Tabs, account-add UI)
is 2c, with different verification and an on-device review.

- ServiceDiscovery: the RFC 6764 ladder. SRV priority/weight, TXT path=,
  non-443 ports, "." targets, well-known then root.
- CollectionClassifier: the two filters that are inversions of the obvious
  rule. An absent or empty supported-calendar-component-set means "supports
  everything", and classification is a positive test for CALDAV:calendar on an
  unordered set — excluding schedule-outbox would drop SOGo's main calendar.
- CalDavDiscovery: OPTIONS gate, principal, every home set, Depth-1 by name.
  A failing home set does not fail the account, and every home set failing is
  reported as an error rather than as an account with no lists.
- NextcloudLoginFlow: POST not GET, a User-Agent the user can recognise when
  revoking, 404-means-pending only, both URLs origin-checked, host mismatch
  carried rather than refused (reverse proxies are ordinary).
- PreemptiveBasicInterceptor, ServerQuirks.

dnsjava 3.6.3 (BSD-3) added: Android's DnsResolver is callback-only and cannot
do the TXT path lookup, and JNDI's DNS provider does not exist on Android.
Behind an interface, so every trap is tested with a fake and no network.

:dav gains change 6 — <D:unauthenticated/> is parsed rather than inferred from
a null href, which also fires on a merely non-conformant empty element.

52 tests here, 78 in :dav. SYNC.md's live-probed trap table is executable now.

gradle/libs.versions.toml

@@ -43,6 +43,13 @@ okhttp = "4.12.0"
 # testImplementation and never reaches the APK.
 xpp3 = "1.1.6"
 
+# --- :caldav (our CalDAV protocol layer) -------------------------------------
+# SRV/TXT lookups for RFC 6764 discovery. Android's resolver exposes no SRV API
+# below API 29's DnsResolver (which is callback-only and cannot do TXT paths),
+# and JNDI's DNS provider does not exist on Android at all. dnsjava is what DAVx5
+# uses. BSD-3 — it goes on the attribution screen with the rest.
+dnsjava = "3.6.3"
+
 # --- :provider (vendored dmfs task provider) ---------------------------------
 # Versions the upstream 1.4.2 source was written against. These are its runtime
 # dependencies, not ours — nothing above the data layer touches them, and they
@@ -140,6 +147,9 @@ okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhtt
 okhttp-mockwebserver = { group = "com.squareup.okhttp3", name = "mockwebserver", version.ref = "okhttp" }
 xpp3 = { group = "org.ogce", name = "xpp3", version.ref = "xpp3" }
 
+# :caldav — RFC 6764 service discovery
+dnsjava = { group = "dnsjava", name = "dnsjava", version.ref = "dnsjava" }
+
 # :provider — vendored dmfs task provider (see provider/PROVENANCE.md)
 dmfs-jems = { group = "org.dmfs", name = "jems", version.ref = "dmfsJems" }
 dmfs-jems-testing = { group = "org.dmfs", name = "jems-testing", version.ref = "dmfsJems" }