[Android] Custom headers: URL match uses the Location request header, and Authorization is stripped from every request #4338

Two Android-only behaviours in CustomHttpHeaders.kt (both added in #3988) that differ from iOS and touch auth. They're independent of the URL-matching semantics discussed in #4257.

1. The URL pattern is tested against the request's location header instead of its URL when that header is present: httpRequest.headers.getOrDefault("location", httpRequest.url) in getCustomRequestHeaders. Location is normally a response header, so this looks unintended; iOS always matches against the request URL.

2. onRequest removes Authorization from every request once any custom header is registered (request.headers.remove("Authorization")), even for requests none of the registered patterns match and even if the app never registered an Authorization header. iOS doesn't do this. It can strip an Authorization header set by something else for that request.

Expected: match against the request URL only, and only add/replace headers for requests a registered entry applies to, as on iOS.

Platform: Android. Version: main / 10.3.8.