Sort subresources

This ensures deterministic signatures when requests have multiple
subresources, e.g., multipart uploads.