Remove Bouncy Castle from X.509 key identifier parsing

[araiprof]

Summary

• replace the Bouncy Castle ASN.1 calls used to read SubjectKeyIdentifier and AuthorityKeyIdentifier extensions with the existing WSS4J DER decoder
• preserve the existing empty-array behavior for absent extensions and null behavior for an AKI without a keyIdentifier
• reject truncated, trailing, indefinite-length, overflow, and non-minimal DER encodings

Motivation

ws-security-common declares the Bouncy Castle artifacts as optional, but these key-identifier paths directly linked BC classes. That meant core certificate handling could fail when those optional artifacts were absent. X509Certificate already exposes the encoded extension values, so the small amount of required DER structure can be decoded without selecting or registering a cryptographic provider.

This does not change cryptographic primitive selection and does not make Cryptacular optional. OpenSAML/SAML users still retain their existing dependency path. The public BouncyCastleUtils name and methods are retained for source and binary compatibility.

Malformed encodings are now rejected more strictly; X.509 extensions are required to use DER.

Verification

• targeted AuthorityKeyIdentifierTest: 5 tests passed
• ws-security-common reactor: 4,086 tests passed
• full mvn test reactor: 5,252 tests passed, 0 failures/errors, 14 skipped on JDK 26
• minimal runtime check with BC and Cryptacular absent: SKI and AKI extraction passed