CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

Affects Bouncy Castle for Java LTS before 2.73.12. OERInputStream.parse() walks SEQ, CHOICE and Supplier children recursively with no depth limit, and the bundled IEEE 1609.2 schema is self-referential through signedData. The flag marking that cycle is honoured only by test tooling, not the runtime parser, and the public ETSI entry points parse untrusted bytes before signature verification. A 2-4 KB message with hundreds of nested payloads costs a few bytes per level but several stack frames, producing StackOverflowError.