OCSP responses can contain "singleResponse" items, with revocation status for an individual certificate. These may also have a list of extensions.
In RFC 5280, this list is defined as optional with 1 or more items.
EJBCA, however, sends an empty list if there are no extensions. We should change the behavior to comply with the RFC.