Since I am not the target audience for this, pardon me if this seems like a silly question, but wouldn't just using a custom ClassLoader or even an Agent get this done, without having to full-on fork the JDK?
This project looks like it's trying to conserve the old SecurityManager (from the Java Applet/Webstart days) implementation that's been removed from the OpenJDK tree. The motivation is on the website: only a very small number of people still use this, but if you're one of them and have a legacy application that depends on the old behavior you don't want too many changes.
It requires low level hooks and support from within the JVM, using agents is brittle and difficult to secure, the simplest solution is just to fork. I did spend some time investigating these methods before making the decision.