feat: support OpenRTB 2.6 EIDs in user.eids

[mdanylov-sigma]

Closes #935. Supersedes #954 by @pkowalski-id5, who offered to hand it over; the first commit is his, cherry-picked onto current master.

iOS counterpart: prebid/prebid-mobile-ios#1350 (same API names and default).

What

• ExternalUserId gets the OpenRTB 2.6 provenance fields inserter, matcher and mm, serialized by getJson().
• New PrebidMobile.setEidsPlacement(EidsPlacement): OPEN_RTB_2_6, OPEN_RTB_2_5 or COMPATIBLE (default).
• BidRequest.getJsonObject() places the EIDs after the ORTB config merges.

Changes on top of #954

• Placement runs on the final request JSON, after OpenRtbMerger.globalMerge. It combines user.eids and user.ext.eids (entries already in user.eids are not repeated) and writes that one list to each location the placement enables. Prebid Server drops user.ext.eids whenever user.eids is present (PBS-Go moveEIDFrom25To26, PBS-Java BidRequestOrtb25To26Converter). With EID OpenRTB 2.6 support #935 #954, EIDs sent as user.ext.eids through setGlobalOrtbConfig were lost as soon as the SDK had an EID of its own.
• One serializer. Removed Eid, Uid, User.eids and ExternalUserId.toEid(); both locations carry the objects built by ExternalUserId.getJson().
• No writes into shared state. BasicParameterBuilder copies TargetingParams.getUserExt() instead of putting eids into the publisher's Ext, where they stayed after the IDs were cleared.
• Removed EidsPlacement.inUser()/inUserExt(), which nothing needs now, and kept TextUtils out of ExternalUserId.
• Left out the unrelated dependency bumps; master already has most of them.

Review comments on #954

Comment	Resolution
Shared Ext keeps a stale eids key	user.ext is a copy per request, and placement works on freshly built JSON. Tests: whenAppendParametersWithExternalUserIds_SharedUserExtIsNotModified, eidsPlacement_changedBetweenRequests_leavesNoStaleEids.
Test cleanup resets to OPEN_RTB_2_6	BidRequestTest resets to COMPATIBLE. BasicParameterBuilderTest no longer touches the placement and now also clears userExt.
Default flip; non-default paths untested	Default stays COMPATIBLE, as on iOS. All three placements and the no-EID case are tested against getJsonObject() output.
Both representations built	One list, built once.
CollectionUtils.isEmpty on non-null lists	That code is gone.
Duplicated serialization paths	getJson() is the only serializer.

Notes for reviewers

• Default. With COMPATIBLE, the auction on Prebid Server is unchanged (it reads user.eids, which now holds the full list), and servers that only read user.ext.eids keep working. The cost is EIDs appearing twice in the request. Candidate for the next major: default to OPEN_RTB_2_6 and deprecate the other two.
• Docs. prebid-mobile/pbm-api/android/pbm-targeting-android.md needs the new setting.

Test plan

• ./gradlew :PrebidMobile-core:testDebugUnitTest: 1312 tests, including BidRequestTest, ExternalUserIdTest, BasicParameterBuilderTest, OpenRtbMergerTest and SharedIdTest. The only failure, MraidInternalBrowserActionTest.handleInternalBrowserActionFollowUrlSuccessAndIsMraid_StartActionViewActivity, fails the same way on master (c2d24603); it compares intent flags against BuildConfig.DEBUG.

🤖 Generated with Claude Code