Restricted package testing with much less moving parts.

Instead of loading an unprivileged trampoline class, we can simply use
AccessController.doPrivileged() passing an explicit AccessControlContext
with no-privileges ProtectionDomain.
Fixes to the zero-permission unreflecting.

- Create the ClassLoader in a doPrivileged() block.
- Generated ClassLoader must perform checkPackageAccess().
- Generated ProtectionDomain must have the permission to access the
  package of the class being defined.
Cleaning up method handle lookup
When looking for applicable overloaded methods based on actual
arguments, must consider null values as matching every reference type.