CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split

Affects Bouncy Castle for Java LTS before 2.73.12. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without holding either private key.