Previously, iterating over the map to build up a string slice of groupID candidates resulted in non-deterministic selection of the groupID. Fix that by sorting candidates, and update some integration tests that were only passing because of the issue.

There might be more discussion needed here:

1. The comment at

   syft/syft/pkg/cataloger/java/package_url.go

   Lines 67 to 69 in 8314c0d

   	groupIDS := cpe.GetManifestFieldGroupIDs(manifest, cpe.PrimaryJavaManifestGroupIDFields)
   	// assumes that primaryJavaManifestNameFields are ordered by priority
   	if len(groupIDS) != 0 {

   seems like it was never true, since the array order coming back from GetManifestFieldGroupIDs was non-deterministic due to iterating maps
2. There's no reason to suppose that the lexicographically first group ID is a better choice than whatever group ID happened to win the map iteration.

Fixes #2169, but open to discussion about whether this is the right approach.