CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

Affects Bouncy Castle for Java LTS before 2.73.12. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA verification.