fix(mfi): keep local MFi documents a picker cannot grant lasting access to

[code-new-bie]

A local MFi certificate or private key is kept only through a persistable
URI grant. Some head-unit file pickers cannot give one: on BYD DiLink the
system file picker runs as the system user, Android refuses its grants to
other apps, and the returned URI carries no access at all. Picking a document
there only showed "Could not keep access to the selected certificate", and
local MFi could not be used.

A picked document is now kept, in this order:

1. Through a persistable grant, as before.
2. Otherwise read once through the picker's temporary grant and kept as a
   private copy under files/mfi/.
3. Otherwise its document ID is mapped to a file path (external storage
   volumes, raw downloads, file URIs) and read with READ_EXTERNAL_STORAGE
   (maxSdkVersion 32, asked for when needed) and
   requestLegacyExternalStorage for Android 10, then kept as a private copy.
4. Otherwise the user is asked to pick it from internal storage or a USB
   drive.

Copies are at most 64 KB, replace the previous copy of the same kind, show
as "(private copy)" in the settings, and are excluded from backups and
device transfers. Each step is written to the session log. The runtime
config accepts the copies' file:// URIs besides content:// ones, and
startCarPlay reports settings the runtime config rejects instead of
crashing on every launch.

Verified in a BYD Song PLUS (Android 10): a certificate and key picked from
a USB drive are kept as private copies and CarPlay connects with them.
LocalMfiDocumentsTest covers the path mapping, replacing copies, file names
and the size limit; MfiTargetConfigTest covers the accepted URIs.