Allow security.ignored to be set as a list (e.g. indexed)

In particular this allows a YAML externalization as an array
as opposed to a CSV.