The problem with SecurityException has gone after fixing JDK-8156143.
However, now we have another problem:
If SecurityManager allows only resource file permission and denies all other permissions, the method getResourceAsStream returns null despite the fact that the resource file is in the module.