.jar file result order seems unstable

[tstromberg]

In https://github.com/chainguard-dev/malcontent/actions/runs/12383336327/job/34565818871?pr=719 I added an integration test for java/clean/sonar-csharp-plugin-10.3.0.106239.jar to TestSimple, but the tests failed as the order wasn't stable:

   --- FAIL: TestSimple/java/clean/sonar-csharp-plugin-10.3.0.106239.jar (4.77s)
        samples_test.go:205: Simple output mismatch: (-want +got):
              (
              	"""
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonar/plugins/dotnet/tests/FileService.class: low
            - 	exec/plugin: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/dom/CharacterDataImpl.class: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/impl/xs/XMLSchemaValidator.class: low
              	c2/addr/url: low
              	net/url/embedded: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/impl/dv/SecuritySupport$7.class: low
            - 	fs/file/exists: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonar/plugins/dotnet/tests/OpenCoverReportParser$Parser.class: low
            - 	exec/imports/python: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /javax/xml/transform/sax/SAXSource.class: low
            + 	c2/addr/url: low
            + 	net/url/embedded: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/protobuf/LogImporter.class: low
              	exec/plugin: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/protobuf/TelemetryAggregator.class: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/ModuleConfiguration.class: low
              	exec/plugin: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/impl/XMLErrorReporter$1.class: medium
            - 	anti-static/binary/opaque: medium
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/RoslynReport.class: low
            - 	exec/plugin: low
            + 	fs/file/exists: low
              	fs/file/path: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/impl/dtd/XMLDTDDescription.class: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/protobuf/TelemetryImporter.class: low
            + 	exec/plugin: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/parsers/AbstractDOMParser.class: low
              	c2/addr/url: low
              	net/url/embedded: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /com/google/protobuf/InvalidProtocolBufferException.class: medium
            - 	sus/malicious: medium
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/apache/xerces/impl/XMLVersionDetector.class: low
            - 	c2/addr/url: low
            - 	net/url/embedded: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/xml/sax/helpers/NamespaceSupport$Context.class: medium
            - 	c2/addr/url: low
            - 	discover/process/name: medium
            - 	net/url/embedded: low
            - 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonarsource/dotnet/shared/plugins/WrongEncodingFileFilter.class: low
            + 	# java/clean/sonar-csharp-plugin-10.3.0.106239.jar ∴ /org/sonar/plugins/dotnet/tests/NCover3ReportParser.class: low
              	... // 245 identical, 455 removed, and 467 inserted lines
              	"""
              )

[egibs]

Should we use JSON for this? IIRC with the concurrent, non-deterministic output we saw shuffling for any scan paths with multiple files.