What does Android's network_security_config.xml "cleartextTrafficPermitted" attribute control, and what is the secure default for apps targeting Android 9+?

• A.D) The attribute applies globally to the entire device, not just the app; setting it to false prevents all apps on the device from using HTTP.
• B.B) "cleartextTrafficPermitted" only applies to WebView-loaded URLs and has no effect on network calls made by Retrofit, OkHttp, or other HTTP clients.
• C.C) Android 9 changed the default to "true" for better compatibility; developers must explicitly set it to false in the manifest to enforce HTTPS.
• D.A) "cleartextTrafficPermitted" controls whether the app is allowed to make plaintext HTTP connections; for apps targeting Android 9 (API 28) and above the secure default is false, blocking all cleartext HTTP, ws://, and FTP connections unless explicitly allowed.