@JsonProperty won't work with the abstract ? extends GrantedAuthority type, as Jackson doesn't have a constructor or factory to convert a string into a concrete implementation.
This change adds a factory method which takes a Collection (which Jackson can understand) and uses Spring Security's utility method to convert the Collection of Strings to a Collection of GrantedAuthority instances.
Note: the 'Amy Administrator' user provided by the 'local-users.json|yaml' file is no longer strictly equivalent to those provided in 'local-users.properties'. See #5; correcting that seems to be outside of the scope of a bugfix, as it will result in something that likely requires a new feature release.
cc: @bjsousa @paul.erickson @lyle @apatwary @SPYANG4 @bhill6