fix(security): usesCleartextTraffic移除 + 域名白名单 + JSONObject解析

- AndroidManifest: 移除 usesCleartextTraffic=true
- downloadFile: 增加 ALLOWED_HOSTS 白名单(git.childish-ghost.com/github.com)
- manifest解析: indexOf/substring → org.json.JSONObject

packages/client-android/android/app/src/main/AndroidManifest.xml

@@ -8,7 +8,6 @@
         android:label="Yuzu GCA v0.1.0"
         android:allowBackup="false"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
         android:theme="@style/Theme.AppCompat.DayNight">
 
         <activity