The best way to define a class is to define using an anchor class, which defines its classloader and security policies, and is the only way to define a class in Java 9+ without --add-opens on the command line. The package name of the anchor class must be the same as the new class.

If the conditions are not met, we fall back to calling private methods on the ClassLoader to define classes. This needs --add-opens, otherwise a exception is raised.

Moved global references to the private ClassLoader methods to a separate ClassLoaderMethods class. This means that the global references will be initialized lazily only when needed, to avoid getting an exception on accessing the private methods (if not --add-opens, e.g. in GF Embedded) if they are not needed.

Weld specifies a different package name for proxies than for the original class. 
We change the name of the proxy class using Javassist to keep the original package name so that we can use the Lookup method.
We keep separate Javassist class pools for separate application classloaders, so that applications don't share them.

Discovered a flaw in the solution for ProxyServiceImpl