Add Hashie::Array to allowed YAML serialization classes

What does this MR do and why?

Prior to August 2017, it was possible to serialize personal access data scopes in the database with Hashie::Array if the values came from the API. To preserve backwards compatiblity, add this class to the list of allowed list.

Relates to #378089 (closed)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.