[android] Prevent malformed callbackId from reaching app cordova view

[purplecabbage]

Platforms affected

Android

Motivation and Context

Certain poorly formed callbackId(s) could be used to execute js code in the context of the cordova app.

Description

Uses a regex check to make sure the callbackId requested matches the pattern. This is the same pattern matching code that is already used in iOS.

Testing

Manually tested.

Checklist

• I've run the tests to see all new and existing tests pass
• I added automated test coverage as appropriate for this change
• Commit is prefixed with (platform) if this change only applies to one platform (e.g. (android))
• If this Pull Request resolves an issue, I linked to the issue in the text above (and used the correct keyword to close issues using keywords)
• I've updated the documentation if necessary

[dpogue]

👍