apacheGH-590: Try decrypting encrypted PKCS8 PEM keys only with BC

Override canExtractKeyPairs so that we don't even try the parser if BC
is not registered.

The decryption is implemented only for Bouncy Castle because many Java
versions have various bugs and limitations regarding PBES2.

sshd-common/src/main/java/org/apache/sshd/common/config/keys/loader/pem/PKCS8PEMResourceKeyPairParser.java

@@ -40,6 +40,7 @@
 import org.apache.sshd.common.cipher.ECCurves;
 import org.apache.sshd.common.config.keys.FilePasswordProvider;
 import org.apache.sshd.common.config.keys.KeyUtils;
+import org.apache.sshd.common.config.keys.loader.KeyPairResourceParser;
 import org.apache.sshd.common.session.SessionContext;
 import org.apache.sshd.common.util.GenericUtils;
 import org.apache.sshd.common.util.ValidateUtils;
@@ -73,6 +74,13 @@ public PKCS8PEMResourceKeyPairParser() {
         super(PKCS8_FORMAT, PKCS8_FORMAT, BEGINNERS, ENDERS);
     }
 
+    @Override
+    public boolean canExtractKeyPairs(NamedResource resourceKey, List<String> lines)
+            throws IOException, GeneralSecurityException {
+        return KeyPairResourceParser.containsMarkerLine(lines, BEGIN_MARKER) || SecurityUtils.isBouncyCastleRegistered()
+                && KeyPairResourceParser.containsMarkerLine(lines, BEGIN_ENCRYPTED_MARKER);
+    }
+
     @Override
     public Collection<KeyPair> extractKeyPairs(
             SessionContext session, NamedResource resourceKey,