In Cluster configuration we say "Arrays and lists are not to be used" (and recently added "unless order is truly significant.")

But we already added some new config keys that broke this rule, including:

• DriverParameters.SecurityGroupIDs
• DisabledAPIs
• NewUserNotificationRecipients
• NewInactiveUserNotificationRecipients

These should be changed from lists to maps. For example, instead of

SecurityGroupIDs:
  - a
  - b
  - c

we should have

SecurityGroupIDs:
  a: {}
  b: {}
  c: {}

We can maintain compatibility with old configs the way we did for InstanceTypes: if the JSON value starts with '[', unmarshal into a slice of strings and build an appropriate map. See (*InstanceTypeMap)UnmarshalJSON() in source:sdk/go/arvados/config.go.

We also need a test in lib/config that

• prohibits list/array values on keys that don't have the suffix "List".
• prohibits the suffix "List" on keys whose values aren't lists/arrays.