CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, throwing OutOfMemoryError before the short stream is noticed.