serialize shrinkwrap payload in order

JavaScript objects will serialize in an arbitrary key order because key
enumeration is not well defined.

To avoid this we sort the keys and create a fresh object in a specific
order. v8 will serialize this object in a consistent fashion.

The problem is *probably* caused because `commands.ls` will write keys
to the `pkginfo` in arbitrary order based on disk IO latency and such

lib/shrinkwrap.js

@@ -56,6 +56,9 @@ function shrinkwrap_ (pkginfo, silent, dev, cb) {
 
 
 function save (pkginfo, silent, cb) {
+  // copy the keys over in a well defined order
+  // because javascript objects serialize arbitrarily
+  pkginfo.dependencies = copyOrder(pkginfo.dependencies)
   try {
     var swdata = JSON.stringify(pkginfo, null, 2) + "\n"
   } catch (er) {
@@ -72,3 +75,12 @@ function save (pkginfo, silent, cb) {
     cb(null, pkginfo)
   })
 }
+
+function copyOrder(obj) {
+  var result = {}
+  var keys = Object.keys(obj).sort()
+  keys.forEach(function (key) {
+    result[key] = obj[key]
+  })
+  return result
+}