Remove peppol-commons dependency on ph-bc - #81

What this changes

• Removes the direct ph-bc dependency from peppol-commons; production source has no BC or ph-bc references.
• Uses the provider-neutral ph-security from the released ph-commons 12.4.0 already imported by current master.
• Adds a regression test proving that neither Bouncy Castle nor ph-bc is on the test/runtime classpath while all Peppol AP and SMP G3 trust anchors initialize correctly.

Verification

• Rebased onto current peppol-commons master (12.9.1-SNAPSHOT).
• mvn -pl peppol-commons verify — 30 tests, 0 failures/errors (2 existing skips).
• Runtime dependency-tree filter for all org.bouncycastle artifacts, com.helger.commons:ph-bc, and org.cryptacular:cryptacular is empty.
• The regression test initializes both PeppolTrustedCA.peppolAllAP() and peppolAllSMP() and checks both expected trust anchors in each store.

The prerequisite provider-neutral ph-security change was merged in phax/ph-commons#57 and released in ph-commons 12.4.0. Phase4 already made its direct ph-bc dependency optional in 4.6.1.