feat: build a Google Play bundle alongside the GitHub APK

The app now has two product flavors. `github` is the sideloaded APK as
before, with the same package name and its in-app updater. `play` is a
bundle for Google Play as `org.bulwarkmail.mobile`, without the updater
or the installer permission, since Play forbids apps updating themselves.

- `release-android.yml` builds the Play bundle in a second job, checks
  its signer, package name and permissions, and keeps it as an artifact.
  With `PLAY_SERVICE_ACCOUNT_JSON` set it uploads it to internal testing.
- The Play flavor uses the new Firebase project; the GitHub flavor keeps
  the old one until the app re-registers its token when it changes.
- Widget clicks and the device-sync account type follow the package name.
- Photos come from the system picker without asking for media access,
  and the unused microphone permission from expo-camera is removed.
- A manual workflow run without a tag no longer replaces the APK of the
  latest release.

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkBuildModule.kt

@@ -0,0 +1,18 @@
+package com.anonymous.bulwarkmobile
+
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReactContextBaseJavaModule
+
+/**
+ * Facts about this build that JS can't see on its own. `distribution` is the
+ * product flavor (app/build.gradle): "github" for the sideloaded APK with its
+ * own updater, "play" for the Google Play bundle, which must not update
+ * itself (lib/platform-capabilities).
+ */
+class BulwarkBuildModule(reactContext: ReactApplicationContext) : ReactContextBaseJavaModule(reactContext) {
+    override fun getName() = "BulwarkBuild"
+
+    override fun getConstants(): Map<String, Any> = mapOf(
+        "distribution" to BuildConfig.DISTRIBUTION,
+    )
+}

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkFcmPackage.kt

@@ -16,6 +16,7 @@ class BulwarkFcmPackage : ReactPackage {
             add(BulwarkDeviceSyncModule(reactContext))
             add(BulwarkWidgetsModule(reactContext))
             add(BulwarkPdfModule(reactContext))
+            add(BulwarkBuildModule(reactContext))
             // The bridge registers React Native's own module under this name.
             if (ReactNativeNewArchitectureFeatureFlags.enableBridgelessArchitecture()) {
                 add(BulwarkHeadlessJsTaskSupportModule(reactContext))