Use commons 3.2.2 to pick up BouncyCastle 1.86 (#1190)

Bumps `commons.version` from 3.2.1 to 3.2.2.

commons 3.2.2 manages `bc-jdk18on-bom` 1.86
(OpenIdentityPlatform/commons#326), which fixes CVE-2026-8763 (critical)
and CVE-2026-13506 in `bcprov-jdk18on` 1.84.

OpenDJ itself uses only the FIPS artifacts, and `bc.fips.version` is
already 2.1.3 on master. The bump matters for OpenICF: it imports
`opendj-parent` as its BOM, and that is where its `bcprov-jdk18on`
version comes from. Trivy flags `bcprov-jdk18on-1.84.jar` in OpenICF's
`lib/framework`.

Between 3.2.1 and 3.2.2 the commons parent moves two managed versions:
the BouncyCastle BOM (1.84 → 1.86) and `org.json:json` (20231013 →
20260814); no OpenDJ module depends on either. The `ban-jvnet-parent`
enforcer rule that 3.2.2 adds reaches only the projects that inherit the
commons parent; OpenDJ imports it as a BOM, so the `jaxb-api` and
`jaxb-core` dependencies of `opendj-core` are not affected.

**Merge order:** the OpenICF PR that moves `opendj.version` to
5.2.0-SNAPSHOT follows this one.

**Also fixes #1196.** The retention scan of the JSON access logger that
#1196 reports (`TimestampFilenameFilter`, `JsonFileWriter`) is commons
code, tracked as OpenIdentityPlatform/commons#329 and fixed by
OpenIdentityPlatform/commons#330, which 3.2.2 includes; this version
update is what brings the fix into OpenDJ.