Thanks! Turns out the system needed permissions in more than one place
beside establishing a connection.
Was able to get the code up and running with a couple of more tweaks. Since
every good developer writes test, I decided to use the embedded Derby
database for integration tests. What a nightmare in terms of security! 
Here is a sample of the security permissions needed:
https://db.apache.org/derby/docs/10.12/security/rsecpolicysample.html
Turns out the list is not as big, but I have learned a lot about the Java
security model, which I have never needed to learn. I have been out of the
webapps world for a bit, concentrating on non-public APIs.
The only issue I am encountering is a NPE with the ESTestCase, but the
tests still complete:
Exception thrown by subscriber method
onHeartbeat(com.carrotsearch.ant.tasks.junit4.events.aggregated.HeartBeatEvent)
on subscriber com.carrotsearch.gradle.junit4.TestReportLogger@63de1613 when
dispatching event:
com.carrotsearch.ant.tasks.junit4.events.aggregated.HeartBeatEvent@10eeb8f4
java.lang.NullPointerException
at
com.carrotsearch.ant.tasks.junit4.ForkedJvmInfo.getPidString(ForkedJvmInfo.java:85)