Navigation: deeplink start location vulnerability fix

[mbarta]

This is a back-port of a vulnerability fix from HotwireNative library: hotwired/hotwire-native-android#154

When the navigation graph is created, the Navigation library checks for deep link attributes inside of the Intent's extras. This can be potentially abused to navigate to a location inside of a HotwireWebFragment which is not app's owned domain.

Similar documented case: https://swarm.ptsecurity.com/android-jetpack-navigation-deep-links-handling-exploitation/

The fix is a simple check during navigation graph initialisation which ensures that the host of the deep link start location is the same as host of the NavHost start location set in the Hotwire Native config. If the hosts don't match, navigation to the deep link location is not allowed and is replaced with the start location from config.

[mbarta]

Had to update test libraries for compatibility with Java 21+

[jayohms]

Thank you @mbarta!