Avoid calling depset.to_list()

[filipesilva]

The Bazel performance page shows depset.to_list() as being an anti-pattern that can severely impact performance:

You can coerce a depset to a flat list using to_list(), but doing so usually results in O(N^2) cost. If at all possible, avoid any flattening of depsets except for debugging purposes.

Here we use it in a fair few places to scoop up sources: https://github.com/bazelbuild/rules_nodejs/search?q=.to_list%28%29&unscoped_q=.to_list%28%29