GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/check_i18n.py

@@ -49,6 +49,7 @@ UI_CALL = re.compile(r"\b(setText|setTitle|setMessage|setHint|setPositiveButton|
                      r"new DavException\([^,]+,|new IOException\(|label\(|field\([^,]+,)\s*\(?\s*" + LIT)
 for d in ("src", "android"):
     for dirpath, _, files in os.walk(os.path.join(root, d)):
+        if "/net" in dirpath: continue  # bundled TLS client: internal messages, not UI text
         for f in files:
             if not f.endswith(".java") or f == "L.java":
                 continue