CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check

Affects Bouncy Castle for Java before 1.85. MLSInputStream.readOpaque() decodes a varint length of up to about 1 GiB and allocates a buffer of that size before confirming enough bytes remain. The call is reached on the first fields of unauthenticated wire structures, ahead of any signature or MAC check. A few bytes declaring a maximal length force a gigabyte allocation per message, and a handful of concurrent messages exhaust the heap.