java.io.ObjectStreamClass::forClass and java.io.ObjectStreamField::getType use the caller's loader to determine if it requires package access security permission check if the security manager is present.

Since security manager is deprecated for removal (JEP 411) and setting the security manager is disallowed by default in Java 18, I'm inclined to propose do nothing for this issue.

This issue is created as a tracking purpose.