Default security policy, ${java.home}/lib/security/default.policy, grants permissions for the modules in a run-time image whose code source is jrt URL.

Regression tests for deprivileged modules running with security manager installed may fail when testing with exploded image since the code source of jdk modules is a file URL)

It'd be helpful to some unified mechanism to replace the security policy when testing with an exploded image rather than doing that in individual tests.