1.0.1-beta.2: security audit

Security audit of the app, plus fixes for external sources.

🛡️ Security

• Closed an install path any app on the device could use to make Omnify install
  a file of its choosing.
• The key encrypting repository passwords now lives in Android's key store,
  instead of sitting in plain bytes next to them.
• Android's automatic backup no longer copies the GitHub token and repository
  logins off the device. Use the app's own export instead.
• Source names are escaped before becoming part of an API address.
• Certificate fingerprints are no longer computed on a shared, non thread-safe
  digest.
• Removed six unused release workflows and some dead inherited code.

Most of these came with the code Droid-ify rather than
being introduced here, so other forks of the same base are likely affected.
The external-sources side is Omnify's own.

🔧 Fixes

• No more update offered for a release older than the installed one (Brave
  ships to Play before its GitHub release leaves pre-release).
• An APK with no version in its file name no longer reads as newer than
  everything.
• A malformed APK no longer costs the whole file's language detection.
• External sources are checked for new releases again: each was frozen on the
  version it had the day it was added, Omnify itself included.

🎨 Interface

• Twice as much README shown before "Show more".
• The version list now says when it is still loading.

---

🐛Feedback and bug reports matter a lot at this stage, don't hesitate to open an issue.

🛡️Verify: every release is signed with the same certificate. Compare its
SHA-256 fingerprint (e.g. via apksigner verify --print-certs) against:

F2:2B:D7:B4:63:D8:D8:9C:A1:AC:3B:6C:41:DB:0B:25:AA:C7:7B:86:24:C9:70:E4:52:81:2D:32:19:42:A9:71