CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard

Affects Bouncy Castle for Java FIPS (BC-FJA) bc-fips-debug before 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). LazyEncodedSequence.force() parses the deferred SEQUENCE with a fresh nesting-depth counter instead of inheriting the parent’s remaining budget, and never decrements it. CRLs loaded through X509CRLHolder or the BC CertificateFactory hold revokedCertificates as an unforced lazy sequence, so a 40-50 KB DER CRL nesting around 10,000 SEQUENCEs recurses one frame per level on hashing, comparison or encoding. The resulting StackOverflowError is usually uncaught and kills the handling thread.