Eliminate some uses of mutable default args

See: GH-2163
A few lines below here, we have:
```#!python
         self.allow_external = set(normalize_name(n) for n in allow_external)
 
         # Which names are allowed to install insecure and unverifiable files?
         self.allow_unverified = set(
             normalize_name(n) for n in allow_unverified
         )
```

So actually the use of ```[]``` is perfectly safe. Using ```()``` feels odd, because it implies we specifically expect a tuple (when we don't). That's just a gut feel, not any sort of rule, though. Normally I'd replace an initializer of ```[]``` with ```None``` plus an explicit assignment below, but that's clumsy here.

I'm not against this, just not sure it's worth it.