Set minSdk 21 so consumers stop inheriting implied permissions

[blackbbc]

Problem

defaultConfig had no minSdk, so AGP wrote minSdkVersion="1" into the published AAR manifest:

<uses-sdk android:minSdkVersion="1" />

AGP also strips targetSdkVersion from library manifests entirely — setting defaultConfig.targetSdk and declaring <uses-sdk android:targetSdkVersion="34"/> in the source manifest are both no-ops (verified against AGP 8.6). So consumers fall back to targetSdk == minSdk == 1.

That trips the manifest merger's implied-permission rules in every app depending on this AAR:

rule	permission silently added
lib targetSdk < 4	READ_PHONE_STATE
lib targetSdk < 16 + app requests WRITE_EXTERNAL_STORAGE	READ_EXTERNAL_STORAGE

The implied READ_EXTERNAL_STORAGE carries no maxSdkVersion, so it applies at every API level even when the consuming app caps its own WRITE_EXTERNAL_STORAGE (e.g. android:maxSdkVersion="28").

Fix

Set minSdk 21. With targetSdkVersion absent from the manifest, Android semantics fall targetSdk back to minSdk — 21 clears both the < 4 and < 16 thresholds.

minSdk is the only lever that works here; the comment in build.gradle records why, so nobody deletes it as redundant.

Verification

New AAR manifest:

<uses-sdk android:minSdkVersion="21" />

Dropped into a downstream consumer (XMind bagel, minSdk 26, declares WRITE_EXTERNAL_STORAGE with maxSdkVersion="28") and re-ran the manifest merge. IMPLIED entries in the merger report went from 2 to 0; both READ_EXTERNAL_STORAGE and READ_PHONE_STATE disappeared from the merged manifest, with no other permission affected.

Version bumped to 1.6.1 rather than reusing 1.6, since the artifact content changes.