When we refactored our decision process to fix #239, we broke a subtle
corner case where extensions that are not off-by-default are to be
reported.

This further refactors that logic and adds specific tests around it to
ensure it works as expected and doesn't regress.

Closes #257