CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers

Affects Bouncy Castle for Java FIPS (BC-FJA) bcpkix-fips before 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of authenticity will accept unsigned content.