v0.5.16

Android and Java signing keys. The secrets check now:

• reads signing .properties files (keystore.properties, key.properties, gradle.properties, local.properties, and others whose name mentions key, sign, keystore, release or upload) and ~/.gradle/gradle.properties, so a storePassword/keyPassword kept in plain text is reported, with advice to keep it in touchenv and give it to Gradle as an environment variable (touchenv run --intent "release" STORE_PASSWORD KEY_PASSWORD -- ./gradlew bundleRelease);
• lists Java/Android keystores (.jks, .keystore, .bks) for information: a keystore is safe while its passwords are not in a file and it stays out of repositories and synced folders. One in the Trash or a synced folder (iCloud Drive, Dropbox, OneDrive, Google Drive) counts as a finding. The Android SDK's debug.keystore, whose password everyone knows, is skipped.