avoid direct getInstance and use our own + more ("jruby-style") cleanup
implement (and use) getKeyGenerator and getSecureRandom factory
use getSecureRandom + re-invent RandomHolder & cleanup JRuby methods
setup getSSLContext (for completeness) and cleanup SSL impl classes some
allow to set the OpenSSL.debug with a system property + isDebug helper(s)
deprecate the PEMHandler (seems no longer used)
- we do not want to use PEMReader (deprecated in BC + uses getInstance)
provider PEMUtils that are JS getInstance call free + all the noise around

we're reinventing some of the new org.bouncycastle.openssl.PEMxxx classes since PEMReader (depending on Security factorier) is deprecated anyways in favor of PEMParser ... this will be only needed until we upgrate to BC 1.48/49
PEMReader (BC API depending on provider being registered) avoided
use Ruby runtime's STDOUT instead of Java System.err
BC's `X509CRLObject` depends on security provider being installed (avoid `crl.verify`)
more internal "JRuby" cleanup + renamed `X509StoreCtx` in a binary compatible way