Document immutable requirement of SharedPreferences return objects

In particular, make it quite clear that the set returned by
getStringSet() must not be modfied by the app, period; and
add a similar caution about the map returned via getAll().

Also, fix a bug that could lead to unexpected data being committed
if the set instance passed to putStringSet() was mutated by the
app after that call (including mutations after commit() was
invoked).

Bug 7312641

Change-Id: If9a1be1b0669ac879ff7a7dc67a8805548ea10cc