Add Android Binder dispatch, platform/linux+platform/android split, and PawletOS content-cache support

- VesperProfileBinderService + main_android.cpp: real Android AIDL Binder
  service backing IVesperProfileService, wired into Android.bp's srcs
  (previously declared but never implemented).
- SignatureVerifier: real CMS verification on Android too, via a vendored
  static OpenSSL (see third_party/openssl-android/README.md) since
  BoringSSL has no CMS/PKCS#7 support.
- ProfileStore: Android-appropriate data paths.
- Every payload handler split into src/platform/<Name>.h (shared contract)
  + src/platform/linux/<Name>.cpp + src/platform/android/<Name>.cpp, so the
  build system picks the platform instead of #ifdef. Android side is an
  honest "not implemented yet" stub per handler, logged rather than silent.
- content-cache payload + handler: PawletOS-fork-specific, talks to
  PawletCache/pawletcache-server. Not part of vesperprofiled's own
  upstream default.

src/platform/android/Mdm.cpp

@@ -0,0 +1,20 @@
+#include "../Mdm.h"
+
+#include <syslog.h>
+
+// Not yet implemented on Android. A real port needs Android's own
+// device-owner/EMM provisioning flow (DevicePolicyManager), a fundamentally
+// different enrollment model than cloud-init drop-ins.
+
+namespace vesperos::profile::platform::mdm {
+
+bool apply(const ParsedPayload& p) {
+    syslog(LOG_WARNING, "[mdm] not implemented on Android yet, uuid=%s", p.uuid.c_str());
+    return false;
+}
+
+void revert(const ParsedPayload& p) {
+    syslog(LOG_WARNING, "[mdm] not implemented on Android yet, uuid=%s", p.uuid.c_str());
+}
+
+} // namespace vesperos::profile::platform::mdm