GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/org/gingercal/net/AssetRoots.java

@@ -0,0 +1,50 @@
+package org.gingercal.net;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import android.content.Context;
+
+/** Mozilla roots shipped as assets/roots/<sha1(subject)>-<n>.der */
+public final class AssetRoots implements CertVerifier.RootStore {
+    private final Context ctx;
+    private Set<String> names;
+
+    public AssetRoots(Context c) { ctx = c.getApplicationContext(); }
+
+    public synchronized List<byte[]> find(byte[] subjectDer) {
+        try {
+            if (names == null) {
+                names = new HashSet<String>();
+                String[] l = ctx.getAssets().list("roots");
+                if (l != null) for (int i = 0; i < l.length; i++) names.add(l[i]);
+            }
+            String h = CertVerifier.sha1Hex(subjectDer);
+            List<byte[]> out = null;
+            for (int i = 0; names.contains(h + "-" + i + ".der"); i++) {
+                if (out == null) out = new ArrayList<byte[]>();
+                out.add(readAll(ctx.getAssets().open("roots/" + h + "-" + i + ".der")));
+            }
+            return out;
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    static byte[] readAll(InputStream in) throws IOException {
+        try {
+            ByteArrayOutputStream b = new ByteArrayOutputStream();
+            byte[] buf = new byte[4096];
+            int n;
+            while ((n = in.read(buf)) > 0) b.write(buf, 0, n);
+            return b.toByteArray();
+        } finally {
+            in.close();
+        }
+    }
+}