Downgrade normative references to ${java.home}/lib/security/java.security

This is motivated by JEP 162, to ease the transition to modules in JDK 9. The relevant section of http://openjdk.java.net/jeps/162 is:

Review normative specification references to files in $JAVA_HOME and where possible downgrade these references to non-normative status. By downgrading these references then it will allow their location (or format) to be changed in a future release. For example the property file for currencies could be moved into a module-private location.