Xalan 2.7.1 is already included in the version 4.1 to avoid the error ClassNotFoundException: org.apache.xml.utils.URI$MalformedURIException (when using WS-Security). Rampart probably uses this exception in its code. However, Xalan is not used as XSLT engine.
WS-Policy are not used any more in the version 4.1 to configure WS-Security (as it did not work correctly). The configuration of WS-Security is only possible with the parameters modules and service-parameters (http://doc.petalslink.com/display/petalscomponents/Petals-BC-SOAP+4.1.x).
The missing class is provided by Xalan that was excluded from the component packaging. Use the version 2.7.1 of xalan instead of 2.7.0 provided by Axis2 because of a bug about API Transformer.reset()