harden privileges of security manager by delegating to a private helper

To interact with the security system - eg retrieving the ProtectionDomain for a class
- requires privileges. The security manager can, of course, grant itself unlimited privileges,
but that puts it in the risky position of being effectively 'setuid' code,
potentially vulnerable to exploit if it can be tricked into running other code
that should not be privileged.

To make this much more difficult, we delegate sensitive operations to a private helper,
and only grant the privilege override when the call stack shows that we called the helper.
This allows us to minimise the points where privileges may be escalated,
so they can be carefully reviewed.
add basic unit test to ensure that the security manager throws SecurityException by default.

This at least ensures that the algorithm is not so completely broken that it gives StackOverflowError.