Remove peppol-commons dependency on ph-bc

[gregjotau]

Depends on phax/ph-commons#57 and is intentionally a draft until that change is released as ph-commons 12.3.6.

What this changes

• Removes the direct ph-bc dependency from peppol-commons; production source has no BC or ph-bc references.
• Temporarily targets ph-commons-parent-pom 12.3.6-SNAPSHOT so this can be tested against the provider-neutral ph-security change. I will replace this with the released 12.3.6 version before marking the PR ready.
• Adds a regression test proving that neither Bouncy Castle nor ph-bc is on the test/runtime classpath while all Peppol AP and SMP G3 trust anchors initialize correctly.

Verification

• mvn -pl peppol-commons verify — 30 tests, 0 failures/errors (2 existing skips).
• Runtime dependency-tree filter for all org.bouncycastle artifacts and com.helger.commons:ph-bc is empty.
• The test initializes both PeppolTrustedCA.peppolAllAP() and peppolAllSMP() and checks both expected trust anchors in each store.

This is the small downstream follow-up needed after phax/ph-commons#57; phase4 already made its own direct ph-bc dependency optional in phase4 4.6.1.