cli: fix nondeterministic policy generation

[elchead]

Context

This commit introduced a reproducibility issue for the workload policies.

Ticket: AB#4297

Reproducer

Take a simple example pod and generate it multiple times for K3S-QEMU-TDX (or any upstream Kata platform). The policy and hash will change from time to time.

while true; do
/nix/store/8di8ps56s9acndipiqynak6qilrffl97-contrast-1.2.0-pre-cli/bin/contrast \
    generate --skip-initializer --reference-values K3s-QEMU-TDX test.yaml >/dev/null 2>&1
cat test.yaml | yq '.metadata.annotations["io.katacontainers.config.agent.policy"]' | base64 -d | sha256sum
done

Reason:

> diff 2.rego 3.rego 
1451,1452c1451,1452
<             "net.ipv4.ping_group_range": "0 2147483647",
<             "net.ipv4.ip_unprivileged_port_start": "0"
---
>             "net.ipv4.ip_unprivileged_port_start": "0",
>             "net.ipv4.ping_group_range": "0 2147483647"
1720,1721c1720,1721
<             "net.ipv4.ping_group_range": "0 2147483647",
<             "net.ipv4.ip_unprivileged_port_start": "0"
---
>             "net.ipv4.ip_unprivileged_port_start": "0",
>             "net.ipv4.ping_group_range": "0 2147483647"

The serialization of the map elements is nondeterministic.

Proposed changes

• use a btreemap instead of a hashmap in the genpolicy tool, because its JSON serialization is deterministic
• add an e2e test

Additional information

• successful E2E run

[burgerdev]

Nice, thanks a lot!