To add a little more understanding to this:

What you're trying to do with ext['bouncycastle.version'] = '1.72' is override a variable that is created and used by the io.spring.dependency-management plugin you likely have imported at the top of your build.gradle.

Those variables are not exhaustive, nor are they magic. They cover a lot of very common packages, but there are plenty that they don't cover.

Here is a list from the spring docs of the variables that the plugin introduces (or rather, most of them. You can check the source code under the tag for your spring version for a comprehensive list). You'll notice that bouncycastle.version isn't a variable that the plugin actually creates or references.

For transitives that aren't covered by the plugin, I find that gradle's recommended default solution of constraints is best. However, it doesn't give us a remedy for the problem we have here, which is that the desired version of the package only exists in a new package that the old package has moved to.

I didn't find a stellar answer to this question anywhere, so I ended up implementing this at the top of my build.gradle:

configurations.all {
    resolutionStrategy {
        eachDependency { DependencyResolveDetails details ->
            if (details.requested.group == 'org.bouncycastle' && details.requested.name == 'bcpkix-jdk15on') {
                details.useTarget('org.bouncycastle:bcpkix-jdk18on:1.78')
            }
            if (details.requested.group == 'org.bouncycastle' && details.requested.name == 'bcprov-jdk15on') {
                details.useTarget('org.bouncycastle:bcprov-jdk18on:1.78')
            }
        }
    }
}

I'm not in love with this solution, but of everything I've seen it's the most direct answer to the question "how do I replace jdk15on with jdk18on?": you identify usages of jdk15on and replace them with jdk18on.