Collect APEX containers and inventory for offline analysis

[besendorf]

AndroidQF does not currently preserve APEX containers as dedicated evidence. File listings and ordinary APK collection do not provide the original APEX signing material needed for offline investigation of publicly known signing keys.

This adds an apex collection module that preserves complete factory and installed .apex and .capex containers alongside the original APEX inventory. Signature verification, key matching and vulnerability assessment remain the responsibility of MVT.

The module:

• Uses /apex/apex-info-list.xml to associate module names, versions, active/factory flags and original paths with the collected files.
• Collects both installed and preinstalled containers, deduplicating identical paths while retaining their inventory relationships.
• Falls back to the package manager and factory APEX directories when the XML inventory is unavailable or invalid, and reports that metadata coverage as partial.
• Uses ordinary ADB access first and existing su access only for otherwise inaccessible paths.
• Records individual collection failures and continues collecting other files. Failed transfers are not committed as container entries, and encrypted acquisitions use encrypted staging.
• Preserves .capex containers unchanged, including their embedded original APEX. Flattened directories are recorded without recursively copying their contents.

Collection runs by default and with -module apex, independently of APK download and trusted-certificate removal options. The documentation describes the output schema, collection limitations, and the additional archive size and transfer time associated with retaining complete containers.

Validation: go test -tags unbundle ./... passes. Added tests cover byte-for-byte preservation, duplicate paths, plain and encrypted archives, root fallback, failed transfers, invalid inventory fallback, unsafe paths, flattened directories, older Android versions and cancellation. No physical-device testing has been performed.

Related to #43. This provides evidence collection for subsequent analysis rather than implementing the issue's key checks inside AndroidQF.