fix(android): ensure deterministic cipher selection

[kewdex]

Summary

• Fix non-deterministic cipher selection when AES-GCM and RSA have equal capability levels
• Use LinkedHashMap to preserve insertion order as tie breaker
• Reorder ciphers so AES-GCM is preferred over RSA for biometric storage

Problem

Previously, cipher selection used HashMap which has non-deterministic iteration order. When two ciphers had equal capability (AES-GCM and RSA both at 1023), the selected cipher depended on hash bucket ordering, potentially causing inconsistent behavior across devices/installs.

Solution

• Changed HashMap to LinkedHashMap to preserve insertion order
• Changed capability comparison from < to <= so first match wins
• Ordered ciphers by capability descending with preferred ciphers first

Test plan

• e2e test added to verify AES-GCM is selected over RSA for biometric access control