GHSA-8h88-gxp3-j7pg: openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys

The PublicKeyBundle.from_dict() method in openssl_encrypt/modules/key_bundle.py at lines 329-361 creates bundles from untrusted data without verifying the signature. The docstring warns to call verify_signature() after creation, but the to_identity() method (line 363-391) can convert an unverified bundle directly to an Identity object.