So what precisely does it mean for a language to be "supported" in Android?
In terms of the OS itself, it means that strings and other locale-specific resources are available to device manufacturers. Usually, this also means that currently-maintained apps in the Android Open Source Project (AOSP) also support the same languages.
This does not mean that device manufacturers are forced to include those resources. Device manufacturers routinely remove unnecessary resources, where "unnecessary" is determined by the market(s) in which they are distributing the particular device.
We will be shipping it on some Samsung Galaxy Tab 4 tablets running Lollipop 5.02.
Part of your decision criteria for your device choice should have been "will it support the languages that I want?". For example, a Galaxy Tab 4 purchased in Germany is more likely to support German than is a Galaxy Tab 4 purchased in Greece, Georgia (the republic), or Georgia (the US state).
On the whole, from what I've seen, Nexus/Pixel devices do the best job of supporting all the languages that the AOSP offers.
How do I add a "supported" language to the choices (and the associated glyphs, etc) in Settings...Language and Input?
Install a custom ROM that has those resources. Or, create your own custom ROM that has those resources.
In principle, on a rooted device, you might be able to add resources, but you would not only need to supply standard Android resources, but other resources that the device manufacturer may have added, either to the core OS or to pre-installed apps. This part would be difficult, at best.
Is there a way to do that programatically from our app?
No.
Is language support considered an attribute of the application or the operating system on in the Android universe?
Both. Or, more accurately:
Google determines what languages are available for Android as an open source operating system.
Device manufacturers determine what languages that they will support on a given device. Nowadays, that is usually a subset of the AOSP-supported languages, or at best all of the AOSP-supported languages. Device manufacturers used to create their own translations for languages that Android lacked but were relevant to markets that the manufacturers wanted to support. My guess is that this is less common nowadays, though it probably still happens to some extent.
App developers determine what languages their own apps will support, in terms of string translations and related locale-specific resources that are unique to their app.
From the user's standpoint, the relevant part is the intersection of what their device supports and what their desired apps support.