CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key

Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select the weak branch, brute-force the key offline and produce a valid MAC over a modified store, for example injecting a rogue trusted CA.