CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input

Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, causing OOM or pinning a worker thread.