Settings: add airplane mode disable authentication

[Datawav]

Refs GrapheneOS/os-issue-tracker#6059

This proof of concept adds an opt-in, off-by-default "Require authentication to turn off airplane mode" switch under Network & internet.

When enabled, both legacy and Catalyst Settings airplane-mode toggles use the active user's standard operating-system authentication prompt before disabling airplane mode. The prompt accepts a strong biometric or the existing device credential (PIN, pattern, or password); it does not create or store a separate password. Enabling airplane mode remains immediate.

Cancellation, authentication error, or lockout leaves airplane mode enabled. The implementation allows one Settings prompt at a time, cancels and releases it with the preference lifecycle, and rechecks the live setting before applying the authenticated change. The option is only shown when the current user has a secure lock configured. Disabling the protection itself also requires fresh system authentication on both legacy and Catalyst paths.

The Catalyst hierarchy has first-class metadata for the opt-in. Preferences API writes remain able to enable airplane mode, but external false or unknown-value writes cannot disable airplane mode or the protection while authentication is required. A background public-slice request cannot bypass the gate: if Settings cannot present the standard prompt, the operation fails closed and airplane mode stays enabled. The network screen still declares an incomplete Catalyst hierarchy, so the XML preference remains part of the rendered screen.

This is accidental-activation protection rather than a central radio policy.

Depends on GrapheneOS/platform_frameworks_base#437 for the protected global setting and coordinated SystemUI coverage.

Test: not run; building GrapheneOS was intentionally not attempted on the resource-constrained development host. git diff --check passed, modified XML parsed successfully, the complete cross-repository diff received Sol static review, and an independent immutable-diff Claude Opus review passed before publication. Suggested upstream targets are SettingsRoboTests and SettingsUnitTests for the added and updated airplane-mode test classes.