XACML Subject, Action, Resource and Environment should use List rather than Set

List can hold duplicates where as set cannot.

XACML spec has the bag functionality such as the following request:

===============
<?xml version="1.0" encoding="UTF-8"?>
<Request
xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation=" urn:oasis:names:tc:xacml:2.0:context:schema:os
http://docs.oasis-open.org/xacml/access_control-xacml-2.0-context-schema-os.xsd">
<Subject>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>Julius Hibbert</AttributeValue>
</Attribute>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:test-attr"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"> This is IT! </AttributeValue>
</Attribute>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:conformance-test:test-attr"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string"> This is IT! </AttributeValue>
</Attribute>
</Subject>
<Resource>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"
DataType="http://www.w3.org/2001/XMLSchema#anyURI">
<AttributeValue>http://medico.com/record/patient/BartSimpson</AttributeValue>
</Attribute>
</Resource>
<Action>
<Attribute
AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
DataType="http://www.w3.org/2001/XMLSchema#string">
<AttributeValue>read</AttributeValue>
</Attribute>
</Action>
</Request>
=================

So if you add hashcode/equals as in SECURITY-522, you will see that the subject attributes will not be 3 but rather just 2.