Empty allowed_publishers array allows every address to publish

The following behavior appears to be intended. However, it is unintuitive behavior and possibly dangerous.

We wanted to note that if allowed_publishers is ever an empty array in code.move, the following code will allow any address to publish a module:

fun assert_allowed(allowed_publishers: &vector<address>, addr: address) {
    assert!(
        vector::is_empty(allowed_publishers) || vector::contains(allowed_publishers, &addr), 
        error::invalid_argument(EINVALID_ALLOWED_PUBLISHERS),
    )
}