Add service descriptor for security manager class
SecurityManager must have public constructor for service loading to work
Avoid JDK bug where the exact call stack depth is relied upon for member access, and fix special Atomic*FieldUpdater cases
Slightly more strict checking
Add support for parametric privileged actions which do not allocate an extra object