serialize shrinkwrap payload in order

JavaScript objects will serialize in an arbitrary key order because key
enumeration is not well defined.

To avoid this we sort the keys and create a fresh object in a specific
order. v8 will serialize this object in a consistent fashion.

The problem is *probably* caused because `commands.ls` will write keys
to the `pkginfo` in arbitrary order based on disk IO latency and such
graceful-fs@2.0.2

Related to #4557, as this will enforce sorting of all
readdir() calls, so dependencies etc will be in consistent
orders on systems that don't sort dir listings internally