fix: remove the dependency on protobuf-lite for tombstones

[supervacuus]

📜 Description

As the title says, it replaces the dependency on a huge generic protobuf decoder with a tiny tombstone-specific package called epitaph (GH, central). The dependency is MIT licensed and can be incorporated into the Sentry ecosystem in whichever ways make sense down the road.

💡 Motivation and Context

Part of the wrap-up milestone in https://linear.app/getsentry/project/tombstone-support-android-0024cb6e3ffd

• eliminates conflicts with client dependencies (Sentry Android SDK (8.30.0) incompatible with Firebase dependencies #5039, fix(dependencies): Downgrade protobuf-javalite from 4.33.1 to 3.25.8 #5044)
• reduces the size of the release AAR by 25%; 371 KiB instead 495 KiB (compared with 8.34.0)
• since the tombstone protobuf format changes very infrequently (many years between changes), having a low dependency direct decoder is a sensible trade-off for a mobile SDK.

https://linear.app/getsentry/issue/ANDROID-267/switch-to-dependency-free-protobuf-runtime

💚 How did you test it?

Tested the same way as the dependency it replaces. The library, though, has a battery of test cases for encoding errors and edge cases.

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

Bug Fixes 🐛

• (screenshot) Add dontwarn replay rules to sentry-android-core by romtsn in #5153

• Remove the dependency on protobuf-lite for tombstones by supervacuus in #5157

---

_{🤖 This preview updates automatically when you update the PR.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: NPE in close() when tombstoneStream is null
  • Added a null guard in TombstoneParser.close() so try-with-resources no longer throws when constructed without an InputStream.

Or push these changes by commenting:

@cursor push 9737b16a1a

Preview (9737b16a1a)

diff --git a/sentry-android-core/src/main/java/io/sentry/android/core/internal/tombstone/TombstoneParser.java b/sentry-android-core/src/main/java/io/sentry/android/core/internal/tombstone/TombstoneParser.java
--- a/sentry-android-core/src/main/java/io/sentry/android/core/internal/tombstone/TombstoneParser.java
+++ b/sentry-android-core/src/main/java/io/sentry/android/core/internal/tombstone/TombstoneParser.java
@@ -349,6 +349,8 @@
 
   @Override
   public void close() throws IOException {
-    tombstoneStream.close();
+    if (tombstoneStream != null) {
+      tombstoneStream.close();
+    }
   }
 }

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}