Bypassing apps (Tor Browser, Briar, OnionShare) are completely blocked when VPN lockdown is on

When "Block connections without VPN" (also known as "VPN lockdown") is turned on for Orbot under Settings > Network & internet > VPN > Orbot (settings gear), none of the [bypass VPN packages](https://github.com/guardianproject/orbot/blob/1fcceebf9728ef33a945afc43b1b8b44b7ab41c7/orbotservice/src/main/java/org/torproject/android/service/OrbotConstants.java#L163-L167) (Tor Browser, Briar, OnionShare) are able to access the network at all.

It doesn't look like the VpnService API offers a way to allow an app to bypass the VPN in lockdown, so solving this isn't easy without OS-level accommodations, but it would be nice for all users to be able to use these apps while still taking advantage of VPN lockdown mode with Orbot.

This might be known, but I didn't see an existing issue about it.

Some thoughts (just thoughts) after a little research on this:
1. VpnService apps *can* track which apps are using which connections, but not via VpnService APIs. It's somewhat hackish and potentially CPU-intensive, requiring looking up the connection and parsing its app uid from `/proc/net/tcp`, `/proc/net/udp`, or `/proc/net/icmp`. This *could* be leveraged to detect connections from bypass packages and protect their sockets from the VPN with [VpnService.protect](https://developer.android.com/reference/android/net/VpnService#protect(int)) so that they truly bypass it.
2. Maybe Orbot and bypassing packages could work together on this in a secure manner, such that bypassing packages could share their socket file descriptors with Orbot (is this possible?) so that Orbot could protect them. This would accomplish the same as 1 without the extra per-packet processing requirement, but it would require changes to both Orbot and to bypassing packages.

Related: #474, #618
Similar, but not quite: #555