Handle empty permissions for packaged apps (bug 1039067)

https://bugzilla.mozilla.org/show_bug.cgi?id=1039067

Handle the case where there aren't any permissions in the manifest which the app-validator helpfully represents as `False` instead of `[]`.
I think `set` creation is going to be a lot slower than using `any`. `any` can also bail out early if it can.

I also don't see the difference between old L165-166 and L165.