Global cleartext traffic restriction
Android already doesn't allow cleartext traffic for newer apps by default, but it does let them opt-in
All of this is handled by StrictMode, and netd has a TLS traffic detection mechanism.
We can re-use that to have a global no cleartext mode, which apps would not be able to override.
This does lead to some funny scenarios, where
- Default connectivity check is HTTP, so that fails, aka "No internet"
- DNS by default is plaintext, which doesn't work, need to enable Private DNS.
- What else?