VectorWebViewActivity and WidgetWebView keep allowFileAccessFromFileURLs / allowUniversalAccessFromFileURLs enabled

Two WebView setup paths still toggle the deprecated `allowFileAccessFromFileURLs` and `allowUniversalAccessFromFileURLs` flags.

### VectorWebViewActivity

`vector/src/main/java/im/vector/app/features/webview/VectorWebViewActivity.kt`:

```kotlin
views.simpleWebview.settings.apply {
javaScriptEnabled = true
...
domStorageEnabled = true

@Suppress("DEPRECATION")
allowFileAccessFromFileURLs = true
@Suppress("DEPRECATION")
allowUniversalAccessFromFileURLs = true

displayZoomControls = false
}
...
val url = intent.extras?.getString(EXTRA_URL) ?: return
```

`EXTRA_URL` is always an http/https URL. The Activity is invoked through `VectorWebViewActivity.getIntent(context, url, ...)`, and every call site that builds that intent (identity-server terms pages, SSO fallback, etc.) supplies an http or https URL. The WebView never loads a `file://` main frame.

### WidgetWebView

`vector/src/main/java/im/vector/app/features/widgets/webview/WidgetWebView.kt`:

```kotlin
@Suppress("DEPRECATION")
settings.allowFileAccessFromFileURLs = true
@Suppress("DEPRECATION")
settings.allowUniversalAccessFromFileURLs = true
```

Widgets are served from the integration server's https widget URL. There is no widget flow that loads a `file://` document.

### Why this matters

Both flags only take effect when the WebView's main frame is itself a `file://` URL. Since neither call site loads one, the flags are not load-bearing for any current path. `allowUniversalAccessFromFileURLs` in particular lets a `file://` page XHR any origin, the classic CWE-200 sandbox escape, and is the reason the docs marked the API deprecated. The `@Suppress("DEPRECATION")` lines suggest the deprecation warning was noticed but the flags themselves were not re-evaluated.

On pre-API-30 devices the WebView defaults are `true` for both, so removing the explicit `true` lines is a tightening on those devices rather than a no-op only on API 30+.

### Suggested fix

Drop both `= true` lines in both files. The https widget and link flows continue to work unchanged.

### Context

This was originally filed against the SchildiChat fork ([SchildiChat/SchildiChat-android#284](https://github.com/SchildiChat/SchildiChat-android/issues/284), [#285](https://github.com/SchildiChat/SchildiChat-android/pull/285)). The maintainer asked me to file it upstream, so this issue is the upstream version. A PR is open at #9145.