Don't depend on Bouncy Castle.

This switches PKCS#7 SignedData generation code from Bouncy Castle to
OpenJDK's proprietary internal API. This is to avoid depending on a
huge library that's not really needed. In the longer term, it's best
to add our own implementation of PKCS#7 SignedData building, parsing,
and verification. This will give the code more power to mimic what the
Android platform does.

Bug: 27461702
Change-Id: I29f1ceea1293e35424fde69c0f2969d551345100