Configuration option for security.limit_extensions

I needed to configure the security.limit_extensions property in the pool configuration file. My preserves the default behaviour (allowing only ".php" files) unless configured otherwise.
Tested and works locally.