CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender

Affects Bouncy Castle for Java before 1.85. GroupKeySet.HashRatchet.get() advances the ratchet one generation at a time up to the requested value and caches every intermediate key in an unbounded map. The generation comes from the SenderData of an incoming PrivateMessage, is a 32-bit value encrypted only under the group-shared sender data secret, and is used before any per-message signature check. Any authenticated member can request a maximal generation and force every other member into roughly two billion HKDF iterations and multi-gigabyte cache growth.