Fix package index ordering

[dillon-giacoppo]

Whilst dict ordering should preserve import order when iterated over keys, it looks like potentially .items() does not preserve insertion order. I can't reliably reproduce (assuming some non determinism is involved) but have examples such as the following:

bazel run @bookworm//:lock

WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian/20241221T204840Z/dists/bookworm/main/binary-amd64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found
WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian-security/20241221T204840Z/dists/bookworm-security/main/binary-amd64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found
WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian/20241221T204840Z/dists/bookworm-updates/main/binary-amd64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found
WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian/20241221T204840Z/dists/bookworm/main/binary-arm64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found
WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian-security/20241221T204840Z/dists/bookworm-security/main/binary-arm64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found
WARNING: Download from https://snapshot-cloudflare.debian.org/archive/debian/20241221T204840Z/dists/bookworm-updates/main/binary-arm64/Packages failed: class java.io.FileNotFoundException GET returned 404 Not Found

It should not be possible to see a 404 for the bare ../Packages URI without additional 404 errors for the compressed indexes such as Packages.xz.

Using a list of tuples will guarantee iteration order.