Hook Android 17 Zygote signatures

[JingMatrix]

Android 17 reworked the app-specialize native methods, so their descriptors no longer resolve and hook_jni_methods skips them, leaving app processes uninjected.

nativeForkAndSpecialize gained a useFifoUi boolean after isTopApp, in both the Java declaration and the native registration table. nativeSpecializeAppProcess is unchanged from U and still resolves through the u entry.

QPR2 goes further and inserts a cgroupUid int between uid and gid in both methods. AOSP has published nothing past android-17.0.0_r1, so this layout comes from the framework.jar of a Pixel 10 Pro XL on QPR2 beta 2, whose debug info names the parameters:

uid, cgroupUid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName,
fdsToClose, fdsToIgnore, startChildZygote, instructionSet, appDataDir,
isTopApp, useFifoUi, pkgDataInfoList, allowlistedDataInfoList,
bindMountAppDataDirs, bindMountAppStorageDirs, bindMountSyspropOverrides

The position matters beyond the descriptor matching: reading cgroupUid as gid would hand every module a wrong gid on an entry that still resolves.

Changes

• Add a c variant of nativeForkAndSpecialize carrying use_fifo_ui.
• Add c_qpr2 variants of both app-specialize methods carrying cgroup_uid, and regenerate jni_hooks.hpp.

Context: Dr-TSNG/ZygiskNext#344.

[JingMatrix]

@jiggs82, please test if CI build of NeoZygisk: https://github.com/JingMatrix/NeoZygisk/actions/runs/30897401244 works for you with Vector 2.2 on your Pixel 10 XL.
If not, please kindly upload logs to help us improve NeoZygisk.