feat: expose setExternalUserIds and upgrade the APS SDKs

[JeromeBonfort]

Amazon forwards third-party identifiers (ID5, LiveRamp...) to the TAM/UAM bidders a publisher
has enabled, but only if the app pushes them. There is no portal switch for this — it is an SDK
API — so until now the app repo had no way to reach it.

What it adds

APSAds.setExternalUserIds([
  { source: 'id5-sync.com', uids: [{ id: 'ID5*…', atype: 2, ext: { linkType: '2' } }] },
]);

The eid is taken in its OpenRTB user.eids shape and passed through untouched: atype and
ext are opaque to us and belong to whoever issued the id. An empty array clears them, which is
what a consent withdrawal needs.

SDK upgrades — both required, the API does not exist in what we pinned

	Was	Now	Minimum that has the API
Android aps-sdk	11.1.1	12.0.1	11.3.0, bisected across the published AARs
iOS AmazonPublisherServicesSDK	5.3.1	5.6.4	between 5.6.2 and 5.6.4 — 5.6.1 does not have it

Checked while bumping, so nobody has to re-check:

• aps-sdk ships no .so, so the 16 KB page-size requirement of Android API 36 does not apply.
• It pulls iabtcf-decoder 2.0.10, the version this package already pins — no conflict.
• minSdk rises from 23 to 24: the AAR manifests declare minSdkVersion="23" for 11.1.1 and
  minSdkVersion="24" for 12.0.1. No practical impact here (this package already defaults to 24 via
  safeExtGet('minSdkVersion', 24), and footmercatomobile2 sets 24), but the earlier claim that it
  stayed at 23 was wrong.
• Android 12.0.1 still has no equivalent of +[APS setContentUrl:], so the note in the loader
  stands. Only its version reference is updated.

Why only one of the deprecated iOS calls moved

On iOS the new API is non-deprecated only on the APS class, so addCustomAttribute moves there
too. The other five DTBAds calls stay where they are, deliberately.

Amazon deprecates them in favour of +[APS setTestMode:], +[APS setUseGeoLocation:],
+[APS setMraidPolicy:] and +[APS setMraidSupportedVersions:] — none of which are declared in
APS.h. The selectors do exist in the binary (verified with strings on DTBiOSSDK): Amazon
shipped the code and never exposed it. Swift therefore cannot see them, and declaring them
ourselves would bind this package to an undeclared API that could vanish in any release.
removeCustomAttribute has no APS counterpart at all, deprecated or otherwise.

A comment in RNAPSAdsModule.swift records this so the next person does not lose an hour on it.
Worth re-checking when Amazon publishes the headers.

Checks

• yarn test:jest — 42 tests green (6 new)
• yarn tsc:compile
• yarn lint:js:check
• Device validation before npm publish

Note

Version bumped to 2.4.0. master was already at 2.3.0 but unpublished — npm latest is still
2.2.1, so publishing this ships the contentUrl work from #16 at the same time.

#17 (instream video) is open against master in parallel and does not overlap with this branch.