fix(webview): gate setWebContentsDebuggingEnabled on BuildConfig.DEBUG and drop unused allowFileAccess in MathMLRenderer (#303)

Three WebView setup paths exist in the app. MyApplication.kt already wraps
setWebContentsDebuggingEnabled in 'if (BuildConfig.DEBUG)'. The other two
paths were missing the guard:

  - MainActivity.onCreate calls WebView.setWebContentsDebuggingEnabled(true)
    unconditionally at the end of onCreate. On a release build that leaves
    chrome://inspect attachable from any USB-connected machine for any
    WebView the app spawns later. CWE-489.

  - MathMLRenderer.setupWebView does the same thing before constructing
    the renderer WebView. Same exposure.

While in MathMLRenderer, drop settings.allowFileAccess = true. The
renderer only ever loads file:///android_asset/MathML-template.html, and
the android_asset scheme is permitted on every supported Android version
even when setAllowFileAccess(false) is in force. The flag is dead and
the WebView is set up with javaScriptEnabled = true + a JS bridge, so
leaving it on widens the surface for no benefit.

ChapterWebView intentionally keeps allowFileAccess = true because the
custom-font path renders @font-face src: url('file://<path>') against
the user-picked font file.

app/src/main/java/com/aryan/reader/MainActivity.kt

@@ -121,7 +121,9 @@ class MainActivity : AppCompatActivity() {
                 }
             }
         }
-        WebView.setWebContentsDebuggingEnabled(true)
+        if (BuildConfig.DEBUG) {
+            WebView.setWebContentsDebuggingEnabled(true)
+        }
     }
 
     override fun onNewIntent(intent: Intent) {