LUCENE-5650: Enforce read-only access to any path outside the temporary folder via security manager (merged r1596767, r1600310)