Upgrade to post-quantum ready TLS

The single transformation entry point for post-quantum TLS readiness. Moves a repository off the end-of-life jdk15on BouncyCastle artifacts onto a hybrid-capable bctls, raises the protocol floor to TLS 1.3, and offers an ML-KEM hybrid key-exchange group first wherever groups are pinned. Run BuildPqcReadinessInventory first: this recipe cannot reach configuration held outside the repository, and the sites it deliberately skips are visible only in its data tables. It also cannot upgrade the runtime, which is the other half of the job — JEP 527 hybrid key exchange exists on JDK 27 and later only.