fix(dotnet): select deps.json root project deterministically

collectPackages ranged over the libraries map and kept the first
library with type "project" as the root, so Go map iteration order
decided which assembly was reported when multiple project libraries
exist. Iterate sorted library keys so the selection is stable across
runs.

Author: jetersen

pkg/dependency/parser/dotnet/core_deps/parse.go

@@ -2,6 +2,7 @@ package core_deps
 
 import (
 	"context"
+	"maps"
 	"slices"
 	"sort"
 	"strings"
@@ -104,7 +105,8 @@ func (p *Parser) collectPackages(depsFile dotNetDependencies, targetLibs map[str
 	var projectNameVer string
 	pkgs := make(map[string]ftypes.Package, len(depsFile.Libraries))
 
-	for nameVer, lib := range depsFile.Libraries {
+	for _, nameVer := range slices.Sorted(maps.Keys(depsFile.Libraries)) {
+		lib := depsFile.Libraries[nameVer]
 		name, version, ok := strings.Cut(nameVer, "/")
 		if !ok {
 			// Invalid name

pkg/dependency/parser/dotnet/core_deps/parse_test.go

@@ -241,3 +241,20 @@ func TestParse(t *testing.T) {
 		})
 	}
 }
+
+func TestCollectPackagesDeterministicRoot(t *testing.T) {
+	depsFile := dotNetDependencies{
+		Libraries: map[string]dotNetLibrary{
+			"Zebra/1.0.0": {Type: "project"},
+			"Mango/1.0.0": {Type: "project"},
+			"Alpha/1.0.0": {Type: "project"},
+		},
+	}
+
+	// The lexicographically first project library must win regardless of
+	// map iteration order.
+	pkgs, root := NewParser().collectPackages(depsFile, nil, false)
+
+	assert.Equal(t, "Alpha/1.0.0", root)
+	assert.Equal(t, ftypes.RelationshipRoot, pkgs[root].Relationship)
+}