Return an empty ACLs list if the package has no ACLs

fixes https://github.com/fedora-infra/pkgdb2/issues/56
Adjust the unit-tests for the change to always include an ACLs key, even if the list is empty