Android: provide a way to enable cleartext HTTP

[mhsmith]

Is your feature request related to a problem? Please describe.

As mentioned at beeware/toga#1612, recent versions of Android disable unencrypted HTTP connections by default, even to localhost. This prevents writing apps which follow the server-and-WebView pattern.

This can be controlled using the following AndroidManifest settings:

• usesCleartextTraffic, which is all-or-nothing.
• networkSecurityConfig, which lists specific domains or addresses.

Describe the solution you'd like

Initially, I suggest we update the template to always set usesCleartextTraffic="true", so users can run the Positron examples and write similar apps of their own.

Later, we could provide some configuration mechanism in pyproject.toml.

[freakboy3742]

Given that it's needed for postitron-style examples, I'm inclined to agree that we should put a hard-coded workaround in place, and then tackle configurable permissions (#547) as a high-ish priority.

However, I'd suggest that adding a networkSecurityConfig approach would be better in this case. Opening up HTTP for all connections opens up apps to a small risk that users might not be expecting based on ambient Android documentation about HTTP usage; however, opening it up just for localhost is arguably what Android's default behavior should be.