Release: also build AAB; fix keystore key-password guidance

- release.yml android job: build APK + AAB (bundleRelease/bundleDebug)
- androidApp: versionCode overridable via -PappVersionCode (Play requires
  an incrementing versionCode per upload)
- make_release_keystore.sh: PKCS12 has no separate key password (keytool
  ignores -keypass) — print the store password for ANDROID_KEY_PASSWORD

scripts/make_release_keystore.sh

@@ -16,13 +16,14 @@ if [ -e "$OUT" ]; then
   exit 1
 fi
 
+# PKCS12 keystores do not support a separate key password (keytool ignores
+# -keypass), so one password covers both the store and the key.
 STORE_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
-KEY_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
 
 keytool -genkeypair -v \
   -keystore "$OUT" -storetype PKCS12 \
   -alias iris -keyalg RSA -keysize 2048 -validity 10000 \
-  -storepass "$STORE_PASS" -keypass "$KEY_PASS" \
+  -storepass "$STORE_PASS" \
   -dname "CN=Iris Release, OU=Mobile, O=Iris, C=DE"
 
 echo
@@ -35,4 +36,4 @@ echo "  ANDROID_KEYSTORE_BASE64   = $(base64 -w0 "$OUT")"
 echo
 echo "  ANDROID_KEYSTORE_PASSWORD = $STORE_PASS"
 echo "  ANDROID_KEY_ALIAS         = iris"
-echo "  ANDROID_KEY_PASSWORD      = $KEY_PASS"
+echo "  ANDROID_KEY_PASSWORD      = $STORE_PASS   # same: PKCS12 has no separate key password"