Upgrade BouncyCastle (to 1.50)

This PR upgrades the BouncyCastle dependency (and adds the PKI JAR that is no longer part of the provider JAR), switching to `PEMParser` from `PEMReader` for RSA/SHA-1 signature creation.

Signature tests are still passing.