Add an allowlist to restrict access to multidex = "off"

PiperOrigin-RevId: 438478135

src/main/java/com/google/devtools/build/lib/rules/android/AndroidBinary.java

@@ -36,6 +36,7 @@
 import com.google.devtools.build.lib.actions.ParamFileInfo;
 import com.google.devtools.build.lib.actions.ParameterFile;
 import com.google.devtools.build.lib.actions.ParameterFile.ParameterFileType;
+import com.google.devtools.build.lib.analysis.Allowlist;
 import com.google.devtools.build.lib.analysis.AnalysisUtils;
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.FileProvider;
@@ -174,6 +175,12 @@ private static void validateRuleContext(RuleContext ruleContext, AndroidDataCont
       ruleContext.throwWithAttributeError("shrink_resources", "This attribute is not supported");
     }
 
+    if (Allowlist.hasAllowlist(ruleContext, "android_multidex_off_allowlist")
+        && !Allowlist.isAvailable(ruleContext, "android_multidex_off_allowlist")
+        && AndroidBinary.getMultidexMode(ruleContext) == MultidexMode.OFF) {
+      ruleContext.attributeError("multidex", "Multidex must be enabled");
+    }
+
     if (AndroidCommon.getAndroidConfig(ruleContext).desugarJava8Libs()
         && getMultidexMode(ruleContext) == MultidexMode.OFF) {
       // Multidex is required so we can include legacy libs as a separate .dex file.