Provisioning (MDM setup) by QR code - compatible with 16-qpr2

[MoChahadeh]

Summary

Port the Headwind MDM QR-provisioning patch (upstream PR
GrapheneOS#40,
still open against the Android-15 base) onto GrapheneOS SetupWizard2's
16-qpr2 Android-16 branch. The Android-15 fork at
MoChahadeh/grapheneos-setup-wizard
was the source of truth for new files. The full execution plan is in
MDM_PORT_PLAN.md on this branch.

The wizard becomes an enrollment entry point: tapping the Welcome screen 6
times reveals a hidden ZXing-based QR scanner, and a Headwind/MobileIron-
formatted QR provisions the device as device-owner via the standard
ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE intent — no
GrapheneOS-specific bypasses.

Three commits, one per phase:

1. Phase 1 — ZXing/Jackson prebuilts and Soong wiring
   (libs/Android.bp + 5 prebuilt jars/aar; +5 static_libs entries)
2. Phase 2 — new activities, actions, ViewModel, layout, drawables, strings
   (with bug fixes folded in as the files were copied — see below)
3. Phase 3 — surgical edits to WelcomeActivity / WelcomeActions /
   AndroidManifest.xml / activity_welcome.xml for the tap-trigger
   integration. Build-portability adjustments also live here (no
   androidx.activity:activity-ktx, no kotlinx-coroutines).

Bug fixes vs. the original Headwind patch

These were applied as the files were copied from the source fork — the diff
isn't a verbatim port

• Explicit + mutable PendingIntent in AppInstaller — drop
  FLAG_ALLOW_UNSAFE_IMPLICIT_INTENT, set intent.setPackage(packageName)
  so the install-callback intent is explicit. Action namespaced to
  app.grapheneos.setupwizard.INSTALL_COMPLETE.
• HTTPS validation on the APK download URL before the connection opens.
  The QR payload is trusted but the URL must travel over TLS — otherwise
  an on-path attacker can swap the APK before the post-download checksum
  check.
• NPE fix: return after the null-QR-content error branch in
  MdmInstallActions.handleEntry (the original fork posted the error then
  fell through to a qrContent!! dereference).
• BroadcastReceiver lifecycle: register/unregister moved into
  MdmInstallActivity.onStart/onStop with Context.RECEIVER_NOT_EXPORTED.
  The receiver lives on the ViewModel so the activity can pick it up after
  recreation.
• Cancel background work on activity finish: replaced the
  MdmInstallActions singleton Executor with a per-ViewModel single-
  thread Executor + tracked Future list, all cancelled in
  MdmInstallViewModel.onCleared(). (viewModelScope was the plan's first
  recommendation but kotlinx-coroutines is not currently linked into
  SetupWizard2; the plan also offered the Executor + Future path.)
• ActivityResultContract everywhere: ProvisionActivity now extends
  androidx.activity.ComponentActivity with two
  registerForActivityResult launchers (one provisioning, one
  finalization). MdmInstallActivity keeps using the existing
  SetupWizardActivity launcher pattern. The deprecated 3-arg
  onActivityResult is gone.
• Dead code removed: commented PO factory-reset block deleted;
  disableSelfAndFinish() now actually implemented — disables
  WelcomeActivity component (not the whole package, so the factory-reset
  fallback path still works) on successful hand-off.
• Recursion bound in jsonToPersistableBundle (depth ≤ 8) so a
  malicious deeply-nested QR payload can't exhaust the stack.
• Tap threshold as a resource: R.integer.qr_provision_tap_threshold
  rather than a hardcoded 6.
• MdmInstallData singleton replaced with a regular
  class MdmInstallViewModel : ViewModel() scoped to the activity. State
  fields (adminComponentName, downloadLocation, etc.) and the
  BroadcastReceiver moved onto the ViewModel.
• Stale-launcher guard removed from WelcomeActions.initQrProvisioning
  — the fork's if (barcodeLauncher != null) return would skip
  re-registration on activity recreation and leave a launcher bound to a
  destroyed activity.

Compatibility / no-drift notes

• UpdaterSecurityPreviewActivity (new in 16-qpr2) is preserved
  untouched.
• Android.bp change is only a static_libs: append; the
  prebuilt_etc { etc_permissions_app.grapheneos.setupwizard } block and
  the required: entry are untouched.
• The four new permissions are added below the upstream
  OPEN_SECURITY_PREVIEW_SETTINGS line; existing ones are preserved.

Static checks completed in the porting environment

• xmllint clean on all 7 modified/new XML files (manifest, layouts,
  drawables, strings, integers).
• Manifest permissions delta is exactly the four new perms.
• All 36 R.string/R.plurals/R.integer/R.layout/R.drawable/R.id
  references in new code resolve to actual resources.
• { / } brace counts match in all 9 new/edited Kotlin files.
• ZXing classes (ScanContract, ScanOptions, CaptureActivity) and
  Jackson classes (ObjectMapper, JsonNode) verified present in the
  shipped jars/aar.
• kotlinc / m / aapt were not available in the porting environment,
  so type-checking and APK build are deferred to reviewer / CI.