Document go/untrusted-touches

The only public API (that I know!) that let touches pass-through is
FLAG_NOT_TOUCHABLE, so I've put the rules that relate to app-developers
there.

Please let me know if there are any other public APIs that makes a
window let touches pass-through. The other one I know of is
ViewTreeObserver.addOnComputeInternalInsetsListener() that let's you
specify the touchableRegion, but that's not public.

(The feature works regardless of the API used to make the window
pass-through)

The docs are a shorter version of the "Rules" section of
go/untrusted-touches.

Bug: 158002302
Fix: 173022596
Test: Build
Change-Id: Ic7ba68f03587112db2cc93128ac41cb09d443127