If Graylog is run in an FIPS environment there is no
crypto provider available that supports "AES/CBC/ISO10126Padding".
This is likely because this padding standard was withdrawn from ISO in
2007.
It is considered bad practice to leave a subliminal channel in the
padding.

We tried to workaround this by explicitly using BouncyCastle
for the encryption/decryption.

This however creates problems with Oracle Java, because
we strip the signature off the bouncy castle jar while repackaging
it into our Uber-Jar.
In contrast to OpenJDK, Oracle Java does not allow the use
of unsigned Security Providers.

Solution:

Change our secret encryption to using PKCS5Padding instead.
There is a FIPS compatible provider "SunPKCS11-NSS-FIPS"
available which supports "AES/CBC/PKCS5Padding".

For backwards compatibility, we decrypt the ISO10126Padded keys
without stripping the padding, and do that manually.

Fixes #14153

Refs #13525

This seems to happen with FIPS enabled OpenJDK 17