Fix initialization regressions: same-config wipe, reset race, ungated mutation log

[adriantuk]

Follow-up review fixes on top of #26 (feature/additional-logging). Targets the initialization rewrite, where the real risks were found. Each fix is a separate commit describing the issue and the fix.

Fixes

1. Preserve runtime configuration on same-config re-initialization (HIGH — Android + iOS)

The initialize() rewrite reset all service-layer state on every successful call; the only guard was the "already enabled + empty config" case. Every other path — including re-initializing with the same config already in force — fell through to the unconditional reset.

In React Native this is reached routinely: ApproovProvider calls initialize() from a useEffect, and React StrictMode double-invokes effects, Fast Refresh re-runs them, and apps may mount more than one provider. A second initialize() with the same config then silently discarded any configuration applied after the first call — dropping request mutations and, more seriously, exclusion URL regexes, which are security relevant.

Fix: only reset runtime configuration when the config actually changes. Same-config re-init is still forwarded to the platform SDK but preserves service-layer state. Applied identically to ApproovService.java and ApproovService.m.

2. Make the Android initialize() state transition atomic (MEDIUM)

initialize() is not synchronized, yet it performs a multi-field reset that transiently sets isInitialized=false/initialConfig=null on non-volatile static fields, while the interceptor reads them through synchronized getters on OkHttp network threads. A request racing a runtime re-init could observe an inconsistent state and forward a request that should be protected without an Approov token, or re-arm the startup sync gate and stall concurrent requests.

Fix: perform the reset+commit inside synchronized(this) (the SDK network call stays outside the lock so it never blocks the getters). Mirrors iOS, which already does the equivalent inside @synchronized(initializerLock).

3. Gate the Android request-mutation log by log level (LOW)

The new request mutation log used android.util.Log.i directly, so it couldn't be suppressed via setLogLevel and logged the URL + token length on every request. The iOS task mutation log it mirrors uses ApproovLogI, which is gated below INFO.

Fix: add a package-private, level-gated logInfo() on ApproovService and route the interceptor's mutation log through it.

Testing

All run locally on both platforms.

• Android (ApproovServiceRegressionTest): added same-config-preserves and different-config-resets tests. Full suite 45 tests, 0 failures. The same-config test fails without Fix 1.
• iOS (ApproovNativeTests): added same-config-preserves test. All native tests pass; the 3 new assertions fail without the iOS fix.

Not changed (out of scope)

• PR Feature/additional logging #26's own changes verified compile-safe (iOS withErrorCode: mock methods exist; Approov.initialize returns boolean in SDK 3.5.3).
• Minor sessionMetadataCollectionEnabled cross-platform reset divergence and JS-layer observations (index.js Log assignment on the Proxy, approov-provider.js using raw NativeModules) are pre-existing and left untouched.

Related: approov/core-project-approov#562