fix(android): vendor saf_util with a sound pendingResult lifecycle

saf_util 2.0.0 leaves an already-answered MethodChannel.Result behind
in pendingResult: unrelated activity request codes consume (and answer)
the pending picker, and a failed picker launch replies without clearing
the pending state. The next delivery for request 1001 then replies a
second time — IllegalStateException "Reply already submitted" in
MainActivity.onActivityResult, crashing the process.

Vendored at packages/saf_util (BSD-3) with take-and-clear reply
ownership, request codes scoped to the plugin's own pickers, and a
guarded reply on the teardown race.

pubspec.lock

@@ -984,10 +984,9 @@ packages:
   saf_util:
     dependency: "direct main"
     description:
-      name: saf_util
-      sha256: "0cf5fc462fc7e466e1d5608dd5a331d88d6dd6c7b01f62a305aaf469bf3309ea"
-      url: "https://pub.dev"
-    source: hosted
+      path: "packages/saf_util"
+      relative: true
+    source: path
     version: "2.0.0"
   screen_retriever:
     dependency: transitive