A fix for this issue has been released in Script Security Plugin version 1.64. Here is an example of what the JCasC configuration might look like:
security: scriptApproval: approvedSignatures: - staticMethod java.lang.String format java.lang.String java.lang.Object[] - method java.lang.String indexOf int