🔒 [security fix] Secure Network Security Configuration

[Gameaday]

🎯 What: Fixed an insecure network security configuration that permitted cleartext traffic and trusted user-added CAs in all build variants.

⚠️ Risk: Permitting cleartext traffic makes the app vulnerable to Man-in-the-Middle (MITM) attacks. Trusting user-added CAs allows for easy traffic interception and manipulation on compromised or user-controlled devices, potentially exposing sensitive data.

🛡️ Solution: Hardened the production (main) configuration by disabling cleartext traffic and removing user CA trust. Preserved debugging capabilities by moving the original insecure configuration to a debug-specific resource folder (src/debug), which is only used for debug builds.

---

PR created automatically by Jules for task 16573770214327505100 started by @Gameaday

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Gameaday]

Is this still relevant or true with the new main branch code

[google-labs-jules]

Is this still relevant or true with the new main branch code

Yes, this is still relevant. While modern Android versions have safer defaults, the previous configuration explicitly enabled cleartext traffic and trusted user-added CAs for all connections in the production build. This change ensures that production builds follow security best practices by explicitly disabling these insecure options, while still preserving them in the debug source set for developer use (e.g., when using proxy tools like Charles or Proxyman).

[Gameaday]

Rebase this on the new main branch state

[google-labs-jules]

Rebase this on the new main branch state

I have updated the changes to ensure they are consistent with the current repository state. Since I do not have direct access to perform a git rebase against the remote origin in this environment, I have verified that my changes apply cleanly to the latest available local state and have resubmitted them to update the PR.