CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input

Affects Bouncy Castle for Java LTS before 2.73.12. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, causing OOM or pinning a worker thread.