IsVpnActiveTool
Reports whether the active network is carried over a VPN. Requires ACCESS_NETWORK_STATE (checked up front). On API 23+ inspects NetworkCapabilities.TRANSPORT_VPN; on API 30+ it resolves the owning app's package via the public NetworkCapabilities.getOwnerUid(), which the platform only populates for the VPN app itself, so it is usually "unknown". Below API 30 the owner is not exposed publicly and is always "unknown". Below API 23 uses the deprecated TYPE_VPN network info (package always null). Output: is_active, vpn_package_name (nullable / "unknown"). Returns ToolResult.error when permission is missing or on failure.