8229773: Resolve permissions for code source URLs lazily

Reviewed-by: alanb, mullan, rriggs, dfuchs

src/java.base/share/classes/java/security/CodeSource.java

@@ -57,7 +57,7 @@ public class CodeSource implements java.io.Serializable {
      *
      * @serial
      */
-    private URL location;
+    private final URL location;
 
     /*
      * The code signers.