Build OD-8475 reports CVE-2026-8763 and CVE-2026-13506 against Bouncy Castle 1.84. Upgrade the shared version to 1.85, identified by the scanner as fixing both, to keep all five Bouncy Castle libraries aligned.

Validation: full product reactor packaging passed with mvn -pl server-product -am -Dmaven.test.skip=true -Dmaven.source.skip=true package. Verified the distribution contains all five Bouncy Castle jars at 1.85. Tests were skipped; Trivy is unavailable locally, so CI must verify the vulnerability scan.

Fixes OD-3127