chore: upgrade DocuSign Android SDK to 2.1.7 and iOS SDK to 4.3.0 for 2.0.0

[IronTony]

Moves both native SDKs to DocuSign's current releases for 2.0.0, which is still unpublished: Android 2.1.4 to 2.1.7 and iOS 4.1.1 to 4.3.0. The PR also clears the iOS module's Swift 6 warnings and fixes three README instructions that could not work.

Why

• Android 2.1.7 is the version DocuSign's install guide documents. The release notes only say "Bug fixes and Improvements", so the case rests on dependencies. 2.1.4 was built against Glide 4.16 and OkHttp 3.14.9, while expo-image on SDK 55, 56 and 57 already forces Glide 5.0.5 and React Native forces OkHttp 4. 2.1.7 is built against Glide 5.0.4 and OkHttp 4.12.0, moves to RxJava 3 and Room 2.7.2, and drops RxJava 2, slf4j and commons-codec.
• iOS 4.3.0 fixes "double JavaScript invocation causing signing backend errors" in online signing. The podspec's ~> 4.1.1 blocked both 4.2.0 and 4.3.0.

Changes

• android/build.gradle: androidsdk, sdk-common and the stripped AAR path at 2.1.7.
• plugin/src/index.ts: SDK_PDF_VERSION 2.1.7 and SDK_PDF_SHA256 3f9be5ff…, recomputed from DocuSign's CDN. sdk-pdf 2.1.7 still ships GeneratedAppGlideModuleImpl, so the strip stays.
• ios/ReactNativeDocuSign.podspec: DocuSign ~> 4.3.0.
• ios/DocuSignError.swift: the six exception classes restate @unchecked Sendable, which Expo's Exception declares on SDK 55 and 57.
• ios/DocuSignManager.swift: drops ?? [:] on DSMManager.defaultConfigurations(), which is nonnull in both SDK versions.
• README.md:
  • The androidMavenRepo default and the bare-project Maven snippet pointed at maven.docusign.com, which has no DNS record.
  • Bare projects were told to add pod 'DocuSign-iOS-SDK', a pod that stopped at 0.1.3-beta. The podspec already depends on DocuSign.
  • SDK versions, a Kotlin 2.1+ requirement and a 2.0.x compatibility row.
• CHANGELOG.md: a Native SDKs section and a Fixes entry under 2.0.0. The two fix(plugin): clear the adm-zip advisories and the CodeQL maven URL alert #11 entries move from ## Next into 2.0.0's Fixes, verbatim, because 2.0.0 is unpublished.

Consumer-visible changes

• Android dependencies. Gradle resolves these app-wide, so an app on an older OkHttp or Room gets OkHttp 4.12.0 and Room 2.7.2, plus RxJava 3. Compiling the module needs Kotlin 2.1+, because 2.1.7 ships kotlin-stdlib 2.2.10. Expo SDK 55 already uses Kotlin 2.1.20.
• New iOS signing menu. DocuSign 4.2.0 added Print, Download and Download Separate PDFs to the captive signing menu, and no SDK setup key hides them.
• iOS error codes. DocuSign inserted DSMErrorCodeEnvelopeHasWitnessRecipient mid-enum, so their error codes from 1022 up are one higher in native.code. The module never compares them, but dashboards keyed on the raw number would shift.
• CocoaPods lockfile. A committed Podfile.lock keeps 4.1.1 until pod update DocuSign.

Verification

API compatibility:

• Android: javap diff of every DocuSign class the Kotlin module touches. The public API it calls is unchanged. Differences are a new DSEnvironment.IL5_ENVIRONMENT, RxJava 3 types on two helper methods the module does not call, and Kotlin internal names moving from $sdk_debug to $sdk.
• iOS: DSMManager.h and DSMEnvelopesManager.h are byte-identical between 4.1.1 and 4.3.0, as are the setup keys, notification names and userInfo keys the module reads.
• Packaging: no DocuSign AAR has native libraries and minSdk stays 24. The iOS xcframeworks keep the iOS 12.0 minimum, privacy manifests, DocuSign's signing team and the Xcode 26.3 toolchain. DocuSignSDK 4.3.0 now ships a Swift interface, but 4.1.1's DocuSignAPI already had one from the same Swift 6.2.4 compiler, so there is no new toolchain floor.

Builds and runtime, in an Expo SDK 57 / RN 0.86.3 app with expo-image, installed from npm pack of this branch:

• Android:
  • Prebuild wrote a valid stripped 2.1.7 AAR, and checkDebugDuplicateClasses passes.
  • Without the strip, the same task fails on GeneratedAppGlideModuleImpl. I ran that control on 2.1.4; 2.1.7's sdk-pdf ships the same class.
• iOS:
  • pod install resolved DocuSign 4.3.0.
  • The Release simulator build has zero warnings from the module, down from 7.
• Smoke test, identical on the old and new SDKs on each platform:
  • Android release build on an API 36 emulator, iOS Release build on an iPhone 17 simulator.
  • initialize succeeds, isLoggedIn returns false and expo-image renders.
  • A rejected login returns the same DocuSignError (login_failed, auth, HTTP 401).
  • No crashes or linkage errors.

Repo: plugin tsc, build, lint, examples type-check and all 100 Jest tests pass on the rebased branch.

After the rebase onto #11:

• git range-diff shows the four upgrade commits are identical to the ones reviewed before the rebase.
• A package packed from the rebased HEAD (adm-zip 0.6.1, the exact maven URL match, sdk-pdf 2.1.7) wrote a valid stripped AAR in the SDK 57 app and injected the maven repository once.
• A second prebuild left build.gradle byte-identical and reused the cached AAR, and the Android release build passed checkReleaseDuplicateClasses.

Not verified

• A real signing ceremony on either platform. It needs a DocuSign demo account, so the new iOS menu and PDF rendering are untested.
• Physical devices, and an Android release build with R8.

Notes

• Rebased onto main after fix(plugin): clear the adm-zip advisories and the CodeQL maven URL alert #11 merged, with no conflicts.
• The new compatibility row's React Native floor (0.85.x+) is the version Expo SDK 55 pairs with in this repo. It sits next to an older "bare React Native 0.74+" line, which the Kotlin 2.1 requirement now narrows in practice. The older 1.0.x row's "0.82.x" also looks off. Both predate this PR.
• android/build.gradle still declares the module version and versionName as 1.0.5. That was already stale on main.
• Pre-push review returned SHIP before the rebase (ff6f01c) and again after it (b8fc754). It recomputed the sdk-pdf hash, compared the iOS headers byte for byte and checked the dependency versions against the POMs.
• Follow-up on main, not this PR: withDocuSignAndroidStrippedAarFlatDir silently does nothing on the SDK 57 template, because its regex allows one level of brace nesting and allprojects.repositories has two. The build doesn't need it, since android/build.gradle references the stripped AAR by file path.
• Merge with rebase. The five commits are separable: README Maven URL, Android, iOS, Swift warnings, CHANGELOG move.