When we refactored our decision process to fix #239, we broke a subtle
corner case where extensions that are not off-by-default are to be
reported.
This further refactors that logic and adds specific tests around it to
ensure it works as expected and doesn't regress.
Closes #257
