Don't break production servers if an extension cannot initialize.

If an extension raises an exception during initialization, it can take
down a site. This can be useful to see on a developer install, in
order to help fix these problems, but it's pretty bad when a production
site goes down. Instead, we want to just skip loading the extension.

This is just one step of the way toward better sandboxing. Ideally, we'd
be able to mark the extension as having errors, and see that in the
extension list with some meaningful information, but that requires more
plumbing.