Allow PL/Java's class loader to make magic URLs

PL/Java's class loader has historically handled resource lookups
by returning a URL that has a custom URLStreamHandler wired in.
Permission to do that wasn't included in the pljava.policy shipped
with 1.6.0. Fix that. Addresses #322.

Still does not get closer to fixing #266, but at least avoids
making it worse.

pljava-packaging/src/main/resources/pljava.policy

@@ -58,6 +58,8 @@ grant codebase "${org.postgresql.pljava.codesource}" {
 		"charsetProvider";
 	permission java.lang.RuntimePermission
 		"createClassLoader";
+	permission java.net.NetPermission
+		"specifyStreamHandler";
 	permission java.util.logging.LoggingPermission
 		"control";
 	permission java.security.SecurityPermission

pljava/src/main/java/org/postgresql/pljava/sqlj/Loader.java

@@ -342,12 +342,12 @@ private static URL entryURL(int entryId)
 	{
 		try
 		{
-			return new URL(
+			return doPrivileged(() -> new URL(
 					"dbf",
 					"localhost",
 					-1,
 					"/" + entryId,
-					EntryStreamHandler.getInstance());
+					EntryStreamHandler.getInstance()));
 		}
 		catch(MalformedURLException e)
 		{