Bukkit/Bukkit — pull request #880 by cortex93 (2013-06-07 22:15:18+00:00)
Title: [B] Lowers needed jvm permission without breaking plugins compatibility - Fixes BUKKIT-4287

##### The Issue
When running with a security manager, require a global suppressAccessCheck ReflectionPermission because of setAccessible calls. Plugins could use this to replace and defeat the security manager.

##### PR Breakdown

Replace java reflection API setAccessible call by a static method that will handle this security concern.
This method tests for the presence of a security manager. If not present, no change, setAccessible is called as it was previously to avoid breaking plugins compatibility. don't check for accessibility as it could add a unnecessary performance overhead.

If present but the targeted method is public and is owned by a public class, don't do anything, setAccessible is not necessary. I hope a vast majority of plugins will go that way.

If present but the targeted method is not public, then call setAccessible in a privileged action block to limit the need to grant ReflectionPermission "suppressAccessCheck" to the jar only.

A debug trace (FINE Level) is outputted whenever a security manager is set and setAccessible is called on a non public method. Hoping this will convince plugins developer to expose public methods.

#### JIRA Ticket

BUKKIT-4287 - https://bukkit.atlassian.net/browse/BUKKIT-4287

#### Tests
I select plugins that registers public, private, nested listeners.
* Running without security manager : no impact.
* Running with a security manager but suppressAccessCheck not granted : plugins with public method works as expected while others don't (exception is thrown as expected). Auto updater doesn't work cause the same permission is needed in google-json library (https://code.google.com/p/google-gson/issues/detail?id=344).
* Running with a security manager with suppressAccessCheck granted to craftbukkit.jar, plugins and auto-updater work as expected.