Only set security.limit_extensions when not empty

Before we got data types, $security_limit_extensions was an optional
array of string defaulting to undef. It is now an array of string
defaulting to an empty array.

We do not want to emit security.limit_extensions when this array is
empty.