[Android] Custom app permission

This is a suggestion. I noticed that in car entertainment system using the Android system, some applications define a signature permission through the "permission" tag, but do not use it to protect any exported components, that is, use "android:permission" in the component. Is this also a problem that can be written as a rule?

```xml

```

No source file, test, or entry point is named. Start by locating the Android permission queries and their tests, then confirm whether an exported component with a declared but unused signature permission should be reported; done means the rule and regression coverage clearly capture this case.

由索引模型根據 Issue 內容生成。