The sort used by collectRequirements and previously
addTransitiveDependenciesWithForbiddenAccess only compared bundle
symbolic names. When two bundles share the same symbolic name (e.g.
jakarta.annotation-api 1.3.5 and 2.1.1 coexisting in a target), the
stable-sort source order leaks through from a HashSet iteration,
which varies between JVM runs. This caused the "Updating plug-in
dependencies" job to rewrite Plug-in Dependencies classpath
containers on every IDE restart and mark projects dirty.

Add a version tiebreaker (higher version first, matching
PDEState.HIGHER_VERSION_FIRST) followed by bundle id as a final
tiebreaker.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>