CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, causing OOM or pinning a worker thread.