SuppressForbidden, and add a missing test

Author: prdoyle

libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/JavaBaseFileActions.java

@@ -98,6 +98,11 @@ static void zipFile_6_readOnly() throws IOException {
         expectZipException(() -> new ZipFile(readFile().toFile(), OPEN_READ, defaultCharset()).close());
     }
 
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void zipFile_6_readAndDelete() throws IOException {
+        expectZipException(() -> new ZipFile(createTempFileForWrite().toFile(), OPEN_READ | OPEN_DELETE, defaultCharset()).close());
+    }
+
     @EntitlementTest(expectedAccess = PLUGINS)
     static void jarFile_1() throws IOException {
         expectZipException(() -> new JarFile(readFile().toString()).close());

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java

@@ -306,6 +306,7 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
         }
     }
 
+    @SuppressForbidden(reason = "Explicitly checking File apis")
     public void checkFileWithZipMode(Class<?> callerClass, File file, int zipMode) {
         assert zipMode == OPEN_READ || zipMode == (OPEN_READ | OPEN_DELETE);
         if ((zipMode & OPEN_DELETE) == OPEN_DELETE) {