F. Add the `l10n` submodule to `davx5`

[sunkup]

Missing for integrating translations in davx5:

• davx5 still reads strings from davx5-non-ose-strings.

• The English originals for gplay/managed/select need to get a home in davx5 via l10n submodule nested inside davx5-ose submodule:

  davx5/submodule/davx5-ose/l10n/translations/gplay/values-de/strings.xml
  

• davx5-non-ose-strings should no longer be used by anything.

Note the file is strings.xml, not gplay-strings.xml — A decided on uniform file names for all flavours. Checked this can't collide: l10n/translations/{gplay,managed} contain only values-*/ directories, no values/, so the new English values/strings.xml in davx5 is alone.

One trade-off we accept: davx5 can't pin the translations separately any more, it gets whatever commit its davx5-ose points at. So consequently: note also that we can't use dependabot to bump the translations here, since we can only bump direct submodules. Translations will only (automatically) update the moment we bump core. (davx5/.github/dependabot.yml has no gitsubmodule ecosystem at all today, so core bumps stay manual anyway.)

Two ways this fails silently: a missing res srcDir is ignored by the Android build, and a submodule inside a submodule needs --recursive or it isn't there at all. In both cases the build succeeds and just ships English.

Everything below goes into one PR — the davx5-ose pointer bump, the string move and the CI changes depend on each other, and we want to review them together.

Bump davx5-ose

davx5 pins submodule/davx5-ose at e2ab2fcee, which is 28 commits before ffac0f62e (D, PR #2831), the first commit that has l10n at all. So submodule/davx5-ose/l10n doesn't exist yet and none of the srcDirs below would resolve.

• Bump submodule/davx5-ose to current davx5-ose@main -> https://github.com/bitfireAT/davx5/pull/944
• The bump has to be in the same commit as the srcDir swap. Bumping alone turns CI red (core's own verifyTranslations guard fires without a recursive checkout), swapping alone silently ships English.

English originals move into davx5

• New app-non-ose/src/gplay/res/values/strings.xml and app-non-ose/src/managed/res/values/strings.xml, with the contents of davx5-non-ose-strings' gplay/values/gplay-strings.xml and managed/values/managed-strings.xml. Both files are byte-identical to what's already in davx5-translations/sources/, so this is a plain copy plus a rename.
• Merge select/values/select-strings.xml into the existing app-non-ose/src/select/res/values/strings.xml (which today holds only the three translatable="false" ids app_name, account_type, account_type_address_book)
• Mirror workflow in davx5, same shape as the one in B including workflow_dispatch, watching those three files and writing sources/gplay/strings.xml, sources/managed/strings.xml and sources/select/strings.xml. The target file name is strings.xml for every flavour.
• Make sure the App id and private key from B are reachable from davx5 (organization secrets — davx5 is private) — already done: TRANSLATIONS_APP_ID and TRANSLATIONS_APP_PRIVATE_KEY are org secrets with visibility selected and both davx5 and davx5-ose in the list.

Translations come from the nested submodule

• app-non-ose/build.gradle.kts: drop val nonOseStringsDir (line 99), add val translationsDir = rootProject.file("submodule/davx5-ose/l10n/translations") and point the res srcDirs at it: gplay → $translationsDir/gplay, managed → $translationsDir/managed, mgdtest → $translationsDir/managed (its source set is configured by hand, not inherited — the flavor uses initWith(managed), source sets have no such thing). Keep src/standard+gplay/res and src/managed/res.
• select gets no translations srcDir — remove its res { } block entirely. Weblate has no select component (only davx5-ose-strings, davx5-gplay-strings, davx5-managed-strings) and davx5-translations has no translations/select. Select's own strings stay English-only for now; core strings are unaffected. Mirroring sources/select/strings.xml still happens so the component can be added later.
• Remove the davx5-non-ose-strings submodule and its .gitmodules entry (git submodule deinit -f + git rm + drop .git/modules/submodule/davx5-non-ose-strings).
• Remove the davx5-non-ose-strings-ref input and its actions/checkout step from .github/workflows/build-apk.yml — that workflow checks the submodules out by hand instead of using submodules: recursive.
• build-apk.yml: add submodules: recursive to the bitfireAT/davx5-ose checkout step, not to the parent checkout (which has no submodules: at all).
• Every other checkout uses submodules: true, which does not descend into l10n. Switch to recursive in release.yml, all three jobs of test-app-non-ose.yml, and dependency-submission.yml.
• Add a verifyTranslations guard to app-non-ose/build.gradle.kts, wired into preBuild, failing if $translationsDir/{gplay,managed} is missing or empty — same idea as the one in davx5-ose:core/build.gradle.kts. Core's guard already covers davx5 (davx5-ose is an included build, so it keeps its own rootDir), but it only checks translations/ose; gplay/managed would still fail silently.
• Everything in davx5 has to be one commit: app-non-ose/src/<flavor>/res is an automatic res srcDir, so the English strings being in davx5 and in davx5-non-ose-strings at the same time is a Duplicate resources error in the same source set, not an override.
• Switch dev setup and CI to git submodule update --init --recursive / submodules: recursive. Nothing in davx5 documents submodule setup at all right now (grep 'git submodule' → zero hits), so this means adding a note to README.md next to the variant/resource table.

Cleanup afterwards

• Archive bitfireAT/davx5-non-ose-strings. Checked: after this PR nothing references it — no Weblate component points at it, and F-Droid only builds the OSE app.

Acceptance criteria

• Recursive clone, build the gplay flavour → gplay translations are there, no duplicate resource errors
• Build the select flavour → the select_welcome_* strings and app_name are still there
• Build mgdtest → managed strings are still there
• Clone without --recursive, or move l10n/translations/gplay away → the build fails with our guard message instead of shipping English
• Change an English gplay string in davx5 and push → sources/gplay/strings.xml updates and Weblate shows the new source string (this also proves the org secrets resolve from davx5)