Dependabot for Composer ignores group sequence, listing updates in the wrong group

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Composer

### Package manager version

2.8.4

### Language version

PHP 8.3

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

Excerpt:

```yaml
groups:
drupal-core:
patterns:
- "drupal/core*"
drupal-contrib:
patterns:
- "drupal/*"
- "drush/*"
assets:
patterns:
- "npm-asset/*"
misc:
patterns:
- "*"
```

### Updated dependency

drupal/core-composer-scaffold
drupal/core-recommended

### What you expected to see, versus what you actually saw

Updates for the mentioned packages are listed in the "drupal-contrib" group, not in "drupal-core" as expected.
It used to work correctly. No changes to dependabot.yml.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

The report names dependabot.yml, the Composer ecosystem, PHP 8.3, and Composer 2.8.4, but provides no manifest, minimal reproduction, logs, or test. Start by reproducing the group ordering with the shown dependabot.yml excerpt, then locate the relevant Composer grouping tests or implementation; done means the listed drupal/core packages consistently appear in drupal-core rather than drupal-contrib.

Written by the indexing model from the issue text.