CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify

Affects Bouncy Castle for Java LTS before 2.73.12. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature can force an allocation of roughly 17 GB on the verifier, reachable from untrusted SubjectPublicKeyInfo, the JCA LMS providers and CMS content verification.