[RUN-4388] Update Bouncy Castle to 1.84 for additional security fixes

[fdevans]

Summary

• Updates Bouncy Castle dependency from version 1.79 to 1.84
• Addresses multiple CVEs beyond the original CVE-2025-8916
• Only affects build-time RPM package signing (no runtime impact)

Security Fixes

This update includes fixes for:

• CVE-2025-8916 - Already fixed in 1.79, maintained in 1.84
• CVE-2026-0636 - LDAP Injection vulnerability
• CVE-2026-3505 - PGP AEAD resource exhaustion
• CVE-2026-5588 - PKIX signature validation issue
• CVE-2026-5598 - FrodoKEM private key leakage

Impact

• Bouncy Castle is used exclusively for PGP signing of RPM packages during build
• Does not affect Rundeck application runtime or secret encryption
• The encryption issues encountered in the core Rundeck repo do not apply here

Test Plan

• Build packages with the updated dependency
• Verify RPM signatures are valid
• Confirm no build failures

[Copilot]

Pull request overview

Updates the pinned Bouncy Castle version used by the Gradle build (not application runtime) to pick up additional security fixes for RPM/PGP signing during packaging.

Changes:

• Bump bouncyCastleVersion from 1.79 to 1.84 in both root and buildSrc Gradle properties.
• Update the buildSrc/build.gradle mitigation comment to reflect the new Bouncy Castle version.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
gradle.properties	Updates the shared Bouncy Castle version property to 1.84.
buildSrc/gradle.properties	Updates the buildSrc Bouncy Castle version property to 1.84.
buildSrc/build.gradle	Updates the resolution-strategy mitigation comment to reference 1.84.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.