All I know is what I posted in https://community.sonarsource.com/t/access-denied-java-lang-runtimepermission-accessclassinpackage-jdk-internal-org-objectweb-asm/62016/3
I got SonarQube running by adding the two line shown to /usr/lib/jvm/java-11-amazon-corretto.x86_64/lib/security/default.policy but I liked Nathan’s alternative suggestion better.
-RP