HV-2106 Security Fix for ClassLoader Access in fromContext() Method

[simei2k]

This fix addresses a security vulnerability in the [fromContext()]method related to privilege management when accessing the thread's context class loader in environments with a Security Manager.

The vulnerability occurs when accessing the current thread's context class loader without proper privilege management. Without proper handling, this can lead to:

SecurityExceptions not being properly caught and handled

Potential application failures in environments with restrictive security policies

Permission bypass issues in certain environments

This vulnerability was also found in smallrye/smallrye-config@fb0def6 and fixed.,

Resources:

1. smallrye/smallrye-config@fb0def6
2. https://nvd.nist.gov/vuln/detail/cve-2020-1729 [CVE-2020-1729] Ensure utility methods wrapping doPrivileged

[Please describe here what your change is about]
This fix:

1. Checks if a SecurityManager is active
2. Takes the fast path when no SecurityManager is present
3. Properly handles SecurityExceptions

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on licensing, please check here.

---

[marko-bekhta]

Hey,

Thanks for the patch. We've dropped support for the security manager https://hibernate.atlassian.net/browse/HV-1975, and no longer expect that the validator is used within an environment with a security manager.

here you can see how the SM checks were implemented before the removal: #1345

Closing the PR.