[codex] Fix Android code scanning alerts

[66Ton99]

Summary

• fix the explicit clipboard clear PendingIntent used by AlarmManager
• migrate biometric passphrase encryption from AES/CBC/PKCS7Padding to AES/GCM/NoPadding
• remove incompatible legacy biometric keys on cipher init failure so users can re-enable biometrics with a GCM key
• bump the visible Android version to 3.0.15 and clean two import-order violations in the touched accounts module

Root cause

CodeQL reported two high-severity alerts on main: an implicit PendingIntent in clipboard clearing and CBC/PKCS7 biometric encryption. The biometric key spec still generated CBC keys, so the cipher and keystore parameters both needed to move to GCM.

Validation

• ./gradlew assembleDebug
• ./gradlew unitTest coverageReport lintDebug
• ./gradlew :accounts:ktlintCheck 📋ktlintCheck :encryptedstorage:ktlintCheck

Note: the broad local detekt task currently fails on pre-existing InvalidPackageDeclaration findings from the package rename, and is not part of the current GitHub Actions checks.