The extension security indexer should support extension features

Currently, the extension security scanner only uses the extension id to find vulnerabilities.

Problem is that sometime an extension might embed another (in which case the other is supposed to be indicated as extension feature) and the scanner won't search for the embedded one.

Ideally, it should search for the id and also all the features of the extension.