So what would need to happen is to pass the flag set in the test suite module
https://github.com/wildfly/wildfly/blob/08719f328b2d0bdb07c21de4aabfe428966aafc2/testsuite/pom.xml#L554
to the arquillian.xml-s in the TCK module like this
https://github.com/wildfly/wildfly/compare/main...rhusar:mp-tck-secman?expand=1
which currently fails as
https://gist.github.com/rhusar/452a461cf911c88eeaf22bc1e907d056
because the TCKs embed the arquillian-core.jar and then lacks the
necessary permissions to run.

Probably the cleanest way to fix this is to create a shared MP TCK
module and add an
org.jboss.arquillian.container.test.spi.client.deployment.ApplicationArchiveProcessor
implementation that sets up the permissions.xml.

I have fixed that for MP FT via WFLY-16046.