[GHSA-p93r-85wp-75v3] Correct Bouncy Castle package version ranges

[ECD5A]

Summary

Correct the affected version ranges for the three Bouncy Castle Maven artifacts listed in GHSA-p93r-85wp-75v3.

The current ranges assign 1.80.2 and 1.81.1 as fixes for artifacts that never published those versions, and omit two affected release intervals for bcprov-jdk18on.

Changes

• bcprov-jdk14: >= 1.71, < 1.84
• bcprov-jdk15to18: >= 1.71, < 1.84
• bcprov-jdk18on: >= 1.71, < 1.80.2; >= 1.81, < 1.81.1; >= 1.82, < 1.84

Evidence

• The vendor advisory lists affected releases 1.71 through 1.80.1, 1.81, and 1.82 through 1.83, with fixes in 1.80.2, 1.81.1, and 1.84: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905598
• Maven Central shows that bcprov-jdk14 and bcprov-jdk15to18 do not publish 1.80.2 or 1.81.1, while both publish 1.84:
  • https://repo.maven.apache.org/maven2/org/bouncycastle/bcprov-jdk14/maven-metadata.xml
  • https://repo.maven.apache.org/maven2/org/bouncycastle/bcprov-jdk15to18/maven-metadata.xml
• bcprov-jdk18on publishes all three fixed versions:
  • https://repo.maven.apache.org/maven2/org/bouncycastle/bcprov-jdk18on/maven-metadata.xml

Validation

• Limited to one advisory JSON file
• JSON syntax validated
• Exact OSV event ordering checked for all three packages
• git diff --check passes
• No open PR duplicates the GHSA or CVE

Fixes #8994