core: correctly deserialize credentials with empty payload

core: correctly deserialize credentials with empty payload

For example with SetCredential=mycred: the data payload is empty, but it
is still a valid credential.

This reorders the arguments when serializing credentials, so the
possibly empty argument is not at the end of the serialized string. This
way we can still easily use the extract_many_words() machinery, and with
the use of EXTRACT_DONT_COALESCE_SEPARATORS properly deserialize even an
empty credential. This changes LoadCredentials= as well just to keep the
code for (de)serializing both directives in sync.