Change app security group rules to consume JSON

* The 'rules' field on app security group now takes a JSON list of hashes that
  encodes the list of security group rules, rather than a stringified
  representation of that list
* Validation fails with informative error when required rule fields are missing

[#71585132]

Signed-off-by: Matthew Sykes <matthew.sykes@gmail.com>