generate advisories deterministically

currently CVE json (`static/projects/*/CVE-*.cve.json`) is not generated deterministically: the key ordering may be unpredictable. This makes regenerating the site and only spotting the actual differences harder

Start by locating the command or entry point that generates static/projects/*/CVE-*.cve.json, then inspect how advisory keys are assembled. Regenerate a representative advisory and verify that repeated generation preserves key ordering and produces no unrelated differences.

Written by the indexing model from the issue text.