CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI

Affects Bouncy Castle for Java before 1.85. PKIXNameConstraintValidator strips a trailing dot before comparing dNSName values but not rfc822Name or URI values, which are compared with a plain case-insensitive match. A certificate whose email or URI SAN ends in a dot therefore evades an excludedSubtrees entry for the same host and path validation succeeds. An attacker controlling a name-constrained intermediate CA can issue certificates for names the constraints were meant to exclude.