CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption

Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before returning content.