Repository: apple/pkl
File: pkl-core/src/main/java/org/pkl/core/service/ExecutorSpiImpl.java (Java)

Code before:
            .addResourceReader(ResourceReaders.modulePath(resolver))
            .addResourceReader(ResourceReaders.pkg())
            .addResourceReader(ResourceReaders.projectpackage())
            .addResourceReader(ResourceReaders.file())
            .addResourceReader(ResourceReaders.http())
            .addResourceReader(ResourceReaders.https())
            .addModuleKeyFactory(ModuleKeyFactories.standardLibrary)
            .addModuleKeyFactories(ModuleKeyFactories.fromServiceProviders())
            .addModuleKeyFactory(ModuleKeyFactories.modulePath(resolver))
            .addModuleKeyFactory(ModuleKeyFactories.pkg)
            .addModuleKeyFactory(ModuleKeyFactories.projectpackage)
            .addModuleKeyFactory(ModuleKeyFactories.file)
            .addModuleKeyFactory(ModuleKeyFactories.http)
            .addModuleKeyFactory(ModuleKeyFactories.genericUrl)
            .setEnvironmentVariables(options.getEnvironmentVariables())
            .setExternalProperties(options.getExternalProperties())
            .setTimeout(options.getTimeout())
            .setOutputFormat(options.getOutputFormat())
            .setModuleCacheDir(options.getModuleCacheDir());

    try {
      if (options.getProjectDir() != null) {
        var project =
            Project.loadFromPath(
                options.getProjectDir().resolve(PKL_PROJECT_FILENAME),
                SecurityManagers.defaultManager,
                null,
                transformer,
                System.getenv());
        builder.setProjectDependencies(project.getDependencies());
      }

      try (var evaluator = builder.build()) {
        return evaluator.evaluateOutputText(ModuleSource.path(modulePath));
      }
    } catch (PklException e) {
      throw new ExecutorSpiException(e.getMessage(), e.getCause());
    } finally {
      Readers.closeQuietly(builder.getModuleKeyFactories());
      Readers.closeQuietly(builder.getResourceReaders());
    }
  }

  private HttpClient getOrCreateHttpClient(ExecutorSpiOptions options) {
    List<Path> certificateFiles;
    List<byte[]> certificateBytes;
    int testPort;
    try {
      if (options instanceof ExecutorSpiOptions2 options2) {
        certificateFiles = options2.getCertificateFiles();
        certificateBytes = options2.getCertificateBytes();

Review comment (security):
While we're here; this should really use the same security manager as the normal evaluator

```suggestion
                securityManager,
```

Code after:
            .addResourceReader(ResourceReaders.modulePath(resolver))
            .addResourceReader(ResourceReaders.pkg())
            .addResourceReader(ResourceReaders.projectpackage())
            .addResourceReader(ResourceReaders.file())
            .addResourceReader(ResourceReaders.http())
            .addResourceReader(ResourceReaders.https())
            .addModuleKeyFactory(ModuleKeyFactories.standardLibrary)
            .addModuleKeyFactories(ModuleKeyFactories.fromServiceProviders())
            .addModuleKeyFactory(ModuleKeyFactories.modulePath(resolver))
            .addModuleKeyFactory(ModuleKeyFactories.pkg)
            .addModuleKeyFactory(ModuleKeyFactories.projectpackage)
            .addModuleKeyFactory(ModuleKeyFactories.file)
            .addModuleKeyFactory(ModuleKeyFactories.http)
            .addModuleKeyFactory(ModuleKeyFactories.genericUrl)
            .setEnvironmentVariables(options.getEnvironmentVariables())
            .setExternalProperties(options.getExternalProperties())
            .setTimeout(options.getTimeout())
            .setOutputFormat(options.getOutputFormat())
            .setModuleCacheDir(options.getModuleCacheDir());

    try {
      if (options.getProjectDir() != null) {
        var project =
            Project.loadFromPath(
                options.getProjectDir().resolve(PKL_PROJECT_FILENAME),
                securityManager,
                null,
                transformer,
                options.getEnvironmentVariables());
        builder.setProjectDependencies(project.getDependencies());
      }

      try (var evaluator = builder.build()) {
        return evaluator.evaluateOutputText(ModuleSource.path(modulePath));
      }
    } catch (PklException e) {
      throw new ExecutorSpiException(e.getMessage(), e.getCause());
    } finally {
      Readers.closeQuietly(builder.getModuleKeyFactories());
      Readers.closeQuietly(builder.getResourceReaders());
    }
  }

  private HttpClient getOrCreateHttpClient(ExecutorSpiOptions options) {
    List<Path> certificateFiles;
    List<byte[]> certificateBytes;
    int testPort;
    try {
      if (options instanceof ExecutorSpiOptions2 options2) {
        certificateFiles = options2.getCertificateFiles();
        certificateBytes = options2.getCertificateBytes();