Sanity checks in ListMultipleChoice

When saving a form containing a ListMultipleChoice, updateModel() method is called, and the Collection returned as model object is modified in-place to remove the old values and add the newly selected values.

This behaviour breaks the principle of least surprise, as a user may not be aware of those implementation details. Therefore I propose to add a sanity check in updateModel() to verify that getModelObject() always returns the same Collection instance. Otherwise, an exception is thrown explaining the problem, to instruct the user to change the client code accordingly. The current silent behaviour is very disappointing for someone not knowing the internals of ListMultipleChoice, and it's likely that the user gets lost in hours of debugging.

See patch attached. Thanks!