feature: add KB entry for missing FLAG_SECURE screen-capture protection

[ticket-fixer]

Summary

Adds a new low-severity Android KB entry APK_MISSING_FLAG_SECURE that defines the generic vulnerability class in which an Activity window that displays sensitive data never sets the per-Window FLAG_SECURE flag, so its content is capturable by screenshots, screen recording or MediaProjection on every build variant — including the non-debuggable production release build.

This is the canonical rule definition that detection agents (static and dynamic) report against. It is generic: it applies to any sensitive-data Activity window (most commonly a separate lock-screen / incoming-call PHI window) that omits window.setFlags(FLAG_SECURE, FLAG_SECURE) on any code path, and covers the related manifestation of gating the flag behind if (!BuildConfig.DEBUG).

Why a KB entry

FLAG_SECURE is a per-Window flag — a window that does not set it is fully capturable regardless of any other protected window in the app, and the flag cannot be inherited because each Activity extends a framework class directly. There was no existing KB entry for the missing FLAG_SECURE case (the existing APK_SCREENSHOT_DISABLED entry is the opposite, informational finding reported when screenshots are blocked). This entry closes that gap.

Changes

• MOBILE_CLIENT/ANDROID/_LOW/APK_MISSING_FLAG_SECURE/meta.json — title, low risk rating, short description, references (Android FLAG_SECURE/Window.setFlags/setShowWhenLocked, manifest activity element, MediaProjection, CWE-200, OWASP MASVS-STORAGE-2, OWASP MASTG-BEST-0016) and compliance categories (OWASP MASVS L2 / MASVS v2, OWASP Mobile Top 10 M6, HIPAA, GDPR, SOC2).
• description.md — technical detail: per-Window semantics, no inheritance, external capture vectors, the lock-screen/exported-Activity manifestation, and the BuildConfig.DEBUG guard anti-pattern.
• recommendation.md — immediate mitigation (unconditional FLAG_SECURE in onCreate before setContent), permanent fix (shared SecureComponentActivity base class), and a regression-prevention static check.
• context.md — real-world framing, why it happens, impact (PHI/PII exposure, no attach required on production) and business impact.

Verification

• python -m pytest tests/kb_test.py (excluding the live-URL test) — 23 passed.
• All 8 reference URLs verified to return HTTP < 404.
• ruff format --check . and ruff check . pass.

Refs os-35483