[IR] Remove scopeId from BreakInstr as well.

* Even though break targets can be pinned statically, I am going
  for consistency with non-local return handling and am using
  DynamicScope signature for identifying the break target.

  This lets us get rid of all scopeId uses from the code.

  scopeId can then be removed from IRStaticScope later on once
  it is clear it is no longer needed for anything else.

* inlining code is currently broken and might potentially resurrect
  scopeId -- to be fixed later.
cleanup and re-arrange some imports to be more readable
implement BC specific (factory) helpers using BC APIs "directly"

we're trying to avoid registering the java.security provider since it's problematic in environments with multiple runtimes started

+ start implementing our own [security].getInstance factory methods
start using our factory methods instead of the java.security stuff directly
replace Signature.getInstance usage with a BC first than rest of providers one
cleanup PKeyDSA to use our own factories - added `getKeyPairGenerator`
setup our own getMac factory and use it + some minor HMAC cleanup
- mostly do not catch and hide argument to_s conversion errors raised
building strings ( the Java "way" :)
deprecate doWithBCProvider and avoid it in code base (NetscapeSPKI)
generixize getWithBCProvider's Callable lambda interface
NetscapeSPKI now loadable even without the BC API (fails on invocation)
introducing our own NetscapeCertRequest with the get "BC" provider avoided
cleanup Ruby Cipher impl - use our getCipher factory instead of the Java one
finally, we seem to be able to deprecate getWithBCProvider - not used at all
setup tests for our factories and tune them out + initialize BC when ext loads
unfinalize constants (for tests) and only call BC-factories if provider != null
Cipher.getInstance gets tricky due JCE internals - but seems fine the API way
it depends on which provider's classes are loaded with the SunJCE's one it won't work since the internal `JceSecurityManager.INSTANCE.isCallerTrusted()` fails
- but Sun's getCipher(transformation, provider) works without any assumptions being made for the provider to be registered among the Security providers ...
move factories into a new SecurityHelper - allows to change/register provider
- for slightly extreme cases where users want to force using a given provider (and they of course understand the drawbacks)
- also if registering a provider is desired there's a public method to be called
cleanup the `OpenSSL::X509::CRL` impl a bit - as it seemed hard to read
avoid Jave Security get_instance factories and registering BC in pkcs12.rb
avoid direct getInstance and use our own + more ("jruby-style") cleanup
implement (and use) getKeyGenerator and getSecureRandom factory