fix(android): never route notifications through the tunnel (#7160)

Resolves: #5637.

kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt

@@ -196,6 +196,11 @@ class TunnelService : VpnService() {
                 "disallowedApplications",
             ) { addDisallowedApplication(it) }
 
+            // Never route GCM notifications through the tunnel.
+            addDisallowedApplication("com.google.android.gms") // Google Mobile Services
+            addDisallowedApplication("com.google.firebase.messaging") // Firebase Cloud Messaging
+            addDisallowedApplication("com.google.android.gsf") // Google Services Framework
+
             tunnelRoutes.forEach {
                 addRoute(it.address, it.prefix)
             }

website/src/components/Changelog/Android.tsx

@@ -16,6 +16,10 @@ export default function Android() {
         <ChangeItem pull="7151">
           Adds always-on error reporting using sentry.io.
         </ChangeItem>
+        <ChangeItem pull="7160">
+          Fixes an issue where notifications would sometimes not get delivered
+          when Firezone was active.
+        </ChangeItem>
       </Unreleased>
       <Entry version="1.3.5" date={new Date("2024-10-03")}>
         <ChangeItem pull="6831">