fix(spoof): bound future patch dates in updateTo

PatchLevelManager only rejected dates more than ~1 year in the
past. A MITM serving <td>2099-12-31</td> from a spoofed bulletin
response slipped through validation and got written to
security_patch.txt plus resetprop'd. Add a 60-day upper bound past
today using LocalDate.plusDays so month boundaries are handled
correctly. The existing past bound stays.

app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt

@@ -15,6 +15,7 @@ object PatchLevelManager {
     private const val STAGING_FILE = "/data/adb/tricky_store/security_patch.txt.next"
     private const val FLOOR_YYYYMMDD = 20200101
     private const val MAX_PAST_OFFSET = 10000
+    private const val MAX_FUTURE_DAYS = 60L
 
     private val DATE_PATTERN = Regex("^\\d{4}-\\d{2}-\\d{2}$")
     private val PROP_PATTERN = Regex("^SECURITY_PATCH=(.+)$", RegexOption.MULTILINE)
@@ -50,14 +51,24 @@ object PatchLevelManager {
             SystemLogger.warning("PatchLevelManager: $date below floor $FLOOR_YYYYMMDD")
             return
         }
-        val today =
+        val now = LocalDate.now()
-            LocalDate.now().let { it.year * 10000 + it.monthValue * 100 + it.dayOfMonth }
+        val today = now.year * 10000 + now.monthValue * 100 + now.dayOfMonth
         if (today >= dateInt + MAX_PAST_OFFSET) {
             SystemLogger.warning(
                 "PatchLevelManager: $date more than 1y older than today ($today)"
             )
             return
         }
+        val maxFuture =
+            now.plusDays(MAX_FUTURE_DAYS).let {
+                it.year * 10000 + it.monthValue * 100 + it.dayOfMonth
+            }
+        if (dateInt > maxFuture) {
+            SystemLogger.warning(
+                "PatchLevelManager: $date more than $MAX_FUTURE_DAYS days in future ($maxFuture)"
+            )
+            return
+        }
         atomicWrite(date)
         AndroidDeviceUtils.setProperty("ro.build.version.security_patch", date)
         AndroidDeviceUtils.setProperty("ro.vendor.build.security_patch", date)