Avoid direct use of non-exported XStream CompositeClassLoader class

Closes gh-25662

Author: jhoeller

spring-oxm/src/main/java/org/springframework/oxm/xstream/XStreamMarshaller.java

@@ -47,7 +47,6 @@
 import com.thoughtworks.xstream.converters.reflection.ReflectionProvider;
 import com.thoughtworks.xstream.core.ClassLoaderReference;
 import com.thoughtworks.xstream.core.DefaultConverterLookup;
-import com.thoughtworks.xstream.core.util.CompositeClassLoader;
 import com.thoughtworks.xstream.io.HierarchicalStreamDriver;
 import com.thoughtworks.xstream.io.HierarchicalStreamReader;
 import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
@@ -186,7 +185,8 @@ public class XStreamMarshaller extends AbstractMarshaller implements BeanClassLo
 	@Nullable
 	private Class<?>[] supportedClasses;
 
-	private ClassLoader beanClassLoader = new CompositeClassLoader();
+	@Nullable
+	private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();
 
 	private final SingletonSupplier<XStream> xstream = SingletonSupplier.of(this::buildXStream);