Update installation.rst

line 253: it should be # app/config/security.yml
access_control belongs to security.yml not config.yml