CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes

Affects Bouncy Castle for Java LTS before 2.73.12. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of up to about a terabyte and the matching CPU work, before any authenticity check.