fix: provide factory method for jackson to deserialize authorities

@JsonProperty won't work with the abstract ? extends GrantedAuthority type, as Jackson doesn't have a constructor or factory to convert a string into a concrete implementation.

This change adds a factory method which takes a Collection (which Jackson can understand) and uses Spring Security's utility method to convert the Collection of Strings to a Collection of GrantedAuthority instances.

Note: the 'Amy Administrator' user provided by the 'local-users.json|yaml' file is no longer strictly equivalent to those provided in 'local-users.properties'. See #5; correcting that seems to be outside of the scope of a bugfix, as it will result in something that likely requires a new feature release.

cc: @bjsousa @paul.erickson @lyle @apatwary @SPYANG4 @bhill6

Build triggered.

This pull request addresses issue #4 (closed).

Passing build here: https://ia-builds.doit.wisc.edu:8443/job/uw-spring-security-master-pull-requests/86/ (Jenkins crashed during the initial build attempt).

Status changed to merged

mentioned in commit 72029eff