Support multiple role definitions per collection on security.yaml

**security.yaml**:

``` yaml
collections:
  states:
    # currently it's only allowed to set a single role
    update: admin

    # new feature
    create: ['admin', 'manager']
```
