Make the field name an array
<select
name="abilities[]"
id="abilities"
multiple
>
Now, whenever you submit the form, you will get an array of abilities IDs in the Request, so you can iterate:
foreach ($request->abilities as $ability) {
$role->allowTo($ability); // if you can pass an id
}
Otherwise, if allowTo must receive a Model instance:
$abilities = App\Models\Ability::find($abilities); // returns a Collection
$abilities->each(fn ($ability) => $role->allowTo($ability));