Collectors.toUnmodifiableList exposes shared secret

It's possible to gain access to the listFromTrustedArray shared secret by calling the finisher() method on the returned Collector instance.

Noted by Tagir Valeev here: https://github.com/openjdk/jdk/pull/449#issuecomment-704001706