Opt-in trust for user-installed CA certificates (replace always-on src="user")

Problem

res/xml/network_security_config.xml trusts user-installed CAs for every host:

<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system"/>
        <certificates src="user" tools:ignore="AcceptsUserCertificates" />
    </trust-anchors>
</base-config>

That is a MITM risk, especially for a password manager: any CA in the device user store can intercept HTTPS to Nextcloud. It exists so self-hosted servers with a private/internal CA still work.

Idea

Network Security Config cannot be toggled at runtime (it is compiled XML).
So the preferred way to trust user CAs only if the user enables it, needs a runtime solution, not a baked-in XML file solution.

Needs some research whether this is possible to solve at all.

• https://developer.android.com/privacy-and-security/security-ssl
• https://developer.android.com/privacy-and-security/security-config

Since SSO traffic goes through the Nextcloud Files app, may check how the files app handles that.

May we need to build an own TrustManager (or can extend the original one), but that needs definitely a lot of research or another app that already did that work :D

Start with res/xml/network_security_config.xml and the linked Android security documentation to determine whether runtime opt-in trust for user-installed CAs is possible. Compare the approach used by the Nextcloud Files app for SSO traffic and investigate whether a custom or extended TrustManager is required. Done means documenting a viable approach and its scope, or establishing that the requested behavior is not feasible.