fix: provide factory method for jackson to deserialize authorities

@JsonProperty won't work with the abstract '? extends GrantedAuthority' type, as Jackson doesn't have a constructor or factory to convert a string into a concrete implementation.

This change adds a factory method which takes a Collection<String> (which Jackson can understand) and uses Spring Security's utility method to convert the Collection of Strings to a Collection of GrantedAuthority instances.

Note: the 'Amy Administrator' user provided by the 'local-users.json|yaml' file is no longer strictly equivalent to those provided in 'local-users.properties'. See adi-ia/uw-spring-security#5; correcting that seems to be outside of the scope of a bugfix, as it will result in something that likely requires a new feature release.