Patch release-plugin crypto and utility dependencies

[jmanico]

The resolved GPG/Central plugin closures contained advisory matches in Bouncy Castle 1.81 and Plexus Utils 3.5.1/3.6.0. Align the three BC modules at 1.86 and both Plexus uses at compatible 3.6.2, confined to release plugin dependencies.

Validation on implementation commit d110c3594e3c78e46d2b652adadb356df64bf2cb:

• Resolved both complete plugin closures with dependency-plugin 3.11.0: all 28 distinct coordinates, including plugin roots, returned no OSV advisory matches on 2026-09-26.
• Two separate clean exports, fresh Maven repositories/caches and the reference Temurin 17.0.20.1+1/Maven 3.9.16 produced 17 identical payloads. Only the parent POM hash changed versus Modernize build policy and verify release artifacts #185.
• Default GnuPG and optional Bouncy Castle signing each passed with a disposable local test key. Both sets of 17 signatures verified and yielded 102-entry local bundles. The private test key was removed. No production credentials, upload or tag was used.
• All 28 CI checks passed on the implementation commit; Sol and final Astra reviews through 0cb11a6a3bf2c842793c135df62fb9e9eaf2fd64 found no actionable issues, independently checking the signed bundles, reproducibility hashes and dependency closure. All 28 checks also passed on that final evidence-only head before merge.

The checked-in batch 04 validation record contains the full coordinate list and payload/bundle hashes. This does not certify unrelated build dependencies or live Central transport. #111 retains namespace access and a validated-then-dropped staging rehearsal.

Follow-up to #95/#103 and batch 04 in #169.