debug builds are not signed

### Checklist

- [x] the issue is indeed a bug and not a support request
- [x] issue doesn't already exist: https://github.com/kivy/python-for-android/issues
- [x] I have a short, runnable example that reproduces the issue
- [x] I reproduced the problem with the latest development version (`p4a.branch = develop`)
- [x] I used the grave accent (aka backticks) to format code or logs when appropriated

### Versions

- Python: 3.8 and 3.10
- OS: Ubuntu 20.4 and 22.04
- Kivy: 2.1.0
- Cython: 0.29.19
- OpenJDK: 13 and 17

### Description

"Android requires that all APKs be digitally signed with a certificate before they are installed on a device or updated." https://developer.android.com/studio/publish/app-signing.html

And specifically describes signing a debug build https://developer.android.com/studio/publish/app-signing.html#debug-mode

p4a does not sign a debug build. Given the clear statements above, this is a bug.

We are lucky that p4a built apks are usable, this is because the Android Package Manager signs unsigned packages. However the key that it uses depends on tool versions, so it changes with p4a updates that use new tools.

As a consequence after a p4a update, an app update install fails with the message:

```
Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Package org.test.whatever signatures do not match previously installed version; ignoring!]
```

Because the Package Manager auto generated key has changed.

The workaround is to delete the app. But this also deletes the app's private storage. Also the new install makes the app's pubic storage (which does persist) unwritable because the updated app has a new UID.

### Proposed fix

The proposed fix is to have p4a generate and manage a key. The `debug.keystore` could for example be under `~/.buildozer` if p4a is run from Buildozer.

Password privacy doesn't matter, this is not about security. The p4a debug password can be in plain text in p4a.

The first update will still give the message above, as apps transition from the 'we got lucky' key to an explicit key.

As a side effect, release setup get easier if p4a generates keys. The only thing the user needs to supply is one environment variable containing the their password.

No files, tests, or entry points are named. Start by locating p4a's APK build and signing path, then compare its behavior with Android's debug-signing requirements; done means debug APKs use a stable p4a-managed key so updates remain installable across tool updates.

Written by the indexing model from the issue text.