feat(android): add trigger() for onFunction custom-function rules

[ethanpschoen]

Description of this change

Mirrors the showConsent/showPreferences warm/cold WebView dispatch pattern to fire ketch-tag's onFunction rule trigger (ketch('trigger', 'custom', '', options)). Cold boots defer the trigger command until the tag finishes loading, since a custom function has no boot URL param the way consent/preferences do.

• KetchWebView.trigger() / Ketch.trigger() with functionName validation
• Unit tests for functionName validation
• Integration test covering warm/cold dispatch and invalid-name rejection
• Demo button wired into both sample apps

Why is this change being made?

• Chore (non-functional changes)
• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How was this tested? How can the reviewer verify your testing?

Added integration tests, tested using sample app

Related issues

KD-17712

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have evaluated the security impact of this change, and OWASP Secure Coding Practices have been observed.
• I have informed stakeholders of my changes.

---

Note

Medium Risk
New WebView JS bridge path with validated function names reduces injection risk, but cold-boot deferral and experience-gating still touch core SDK WebView lifecycle.

Overview
Adds Ketch.trigger(functionName, options) so apps can fire ketch-tag onFunction rules via ketch('trigger', 'custom', …) on the WebView, using the same warm/cold WebView flow as consent and preferences.

On a warm WebView it calls KetchWebView.trigger immediately. On a cold boot it loads the tag without a show-type URL param, stores a pendingTrigger, and runs the JS trigger in onConfigUpdated after the tag loads. Invalid names are rejected up front with a strict allowlist (quotes, whitespace, etc.) so nothing unsafe is interpolated into the JS call. pendingTrigger is cleared on WebView cleanup.

Unit tests cover name validation; integration tests cover invalid rejection, warm dispatch, and cold deferred dispatch. Compose and standard sample apps add demo buttons for demoFunction.

^{Reviewed by Cursor Bugbot for commit ff649d3. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ff649d3. Configure here.}