Android OS versions: capture security patch level and format as "16 (YYYY-MM-DD)"

[mostlikelee]

Sub-task of #35075.

Layer: android MDM service / datastore · Scope: small

What

Capture SoftwareInfo.securityPatchLevel (a YYYY-MM-DD date) from the Android Management API device report and fold it into the host's OS version so Android versions read as "16 (2026-05-01)" instead of just "16". The major version + security patch level pair is the vulnerability-relevant granularity for Android (AMAPI exposes no "minor" version).

Why

Foundation for the whole story: distinct OS-version rows keyed by patch level are what the OS page aggregates and what subsequent vulnerability matching joins against.

Technical approach

• server/mdm/android/service/pubsub.go: today both the enroll path (addNewHost, ~L917) and the detail-report path (updateAndroidHost, L744) set OSVersion = "Android " + device.SoftwareInfo.AndroidVersion. Append the SPL: when securityPatchLevel != "", format as "Android <ver> (<spl>)".
• updateHostOperatingSystem (pubsub.go:835): include the SPL in the fleet.OperatingSystem.Version so the operating_systems row is distinct per patch level. Confirm Name="Android", Platform="android".
• Guard empty/missing SPL — fall back to bare major version (older devices may not report it).
• Verify host_operating_system upsert treats 16 and 16 (2026-05-01) as separate OS rows (test plan: host transitions from 16 → 16 (2026-05-01) as it checks in).

Acceptance criteria

• Android host detail report persists SPL into OSVersion and the operating_systems row as "16 (2026-05-01)"
• Devices not reporting a SPL still enroll with bare major version, no error
• Android appears in the Software > OS aggregation (/os_versions) and os_name=Android host filter
• MYSQL_TEST=1 REDIS_TEST=1 go test ./server/mdm/android/... passes

[mostlikelee]