avoid direct getInstance and use our own + more ("jruby-style") cleanup
implement (and use) getKeyGenerator and getSecureRandom factory
use getSecureRandom + re-invent RandomHolder & cleanup JRuby methods
setup getSSLContext (for completeness) and cleanup SSL impl classes some
allow to set the OpenSSL.debug with a system property + isDebug helper(s)
deprecate the PEMHandler (seems no longer used)
- we do not want to use PEMReader (deprecated in BC + uses getInstance)
provider PEMUtils that are JS getInstance call free + all the noise around

we're reinventing some of the new org.bouncycastle.openssl.PEMxxx classes since PEMReader (depending on Security factorier) is deprecated anyways in favor of PEMParser ... this will be only needed until we upgrate to BC 1.48/49
PEMReader (BC API depending on provider being registered) avoided
use Ruby runtime's STDOUT instead of Java System.err
BC's `X509CRLObject` depends on security provider being installed (avoid `crl.verify`)
more internal "JRuby" cleanup + renamed `X509StoreCtx` in a binary compatible way
generate some serialVersionUIDs since they've been (on purpose) removed previously
genericsize our Function-al interfaces
use an unify function iterface generics + start hiding private/package state in x509store
allow sharing of our custom `java.security.X509CRL.verify` logic (with BC not installed)
avoid `X509CRL.verify` call and use our helper built to do that (without BC installed)
+ some minor cleanup - only SecurityException should be catched for `System.getenv`