fix: use location RealPath not String() for match sorting

[luhring]

This is a follow-up to #1944. Using String() works mostly for sorting, but I expected String() to return a simple filepath, and instead it returns a funky string like: Location<id=72 RealPath="usr/lib/go/pkg/tool/linux_amd64/buildid">.

This causes issues because the id=<...> value will be sorted lexically, and more than that, it looks like for most paths in Syft, this id value is controlled by an auto-incrementing global variable, so its value will vary quite widely across different execution contexts.

(I'm not sure if anything is depending on this kind of Location< .... > string value... If not, it could potentially be worth considering changing String() to return the RealPath or AccessPath to be friendlier to library consumers.)

This PR updates the sorting logic to use the RealPath for now, which should be stable. Holler if this assumption is incorrect for any reason!