refactor: extract toStringList helper for TomlArray conversion

Deduplicate the TomlArray-to-string extraction loop that appeared
in both members and exclude parsing with identical null/blank filtering.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -966,27 +966,12 @@ private List<Path> discoverUvWorkspaceMembers(Path workspaceDir, Set<String> ign
         return Collections.emptyList();
       }
 
-      List<String> memberPatterns = new ArrayList<>();
-      for (int i = 0; i < membersArray.size(); i++) {
-        String pattern = membersArray.getString(i);
-        if (pattern != null && !pattern.isBlank()) {
-          memberPatterns.add(pattern.trim());
-        }
-      }
+      List<String> memberPatterns = toStringList(membersArray);
       if (memberPatterns.isEmpty()) {
         return Collections.emptyList();
       }
 
-      Set<String> excludePatterns = new java.util.HashSet<>();
-      TomlArray excludeArray = workspaceConfig.getArray("exclude");
-      if (excludeArray != null) {
-        for (int i = 0; i < excludeArray.size(); i++) {
-          String pattern = excludeArray.getString(i);
-          if (pattern != null && !pattern.isBlank()) {
-            excludePatterns.add(pattern.trim());
-          }
-        }
-      }
+      List<String> excludePatterns = toStringList(workspaceConfig.getArray("exclude"));
 
       List<PathMatcher> memberMatchers =
           memberPatterns.stream()
@@ -1027,6 +1012,20 @@ private List<Path> discoverUvWorkspaceMembers(Path workspaceDir, Set<String> ign
     }
   }
 
+  static List<String> toStringList(TomlArray array) {
+    if (array == null) {
+      return List.of();
+    }
+    List<String> result = new ArrayList<>();
+    for (int i = 0; i < array.size(); i++) {
+      String s = array.getString(i);
+      if (s != null && !s.isBlank()) {
+        result.add(s.trim());
+      }
+    }
+    return result;
+  }
+
   /**
    * Checks whether a package.json has "private": true, meaning it should not be analyzed as a
    * publishable package.