1.6.0: opening a ResourceBundle fails

```
Caused by: java.security.AccessControlException: Access denied ("java.net.NetPermission" "specifyStreamHandler")
```
PL/Java's class loader returns resource URLs that have a custom stream handler bound in. Leaving that permission out of the policy shipped with 1.6.0 was an oversight.