(#11996) Fix graph cycle reporting order after hash changes.

CVE-2011-4815 changed the order of hash processing, and our simple graph class
is heavily based on them. This revealed that the content of cycle reporting
is dependent on the processing order of a hash - and, so, is no longer
consistent.

This updates the code to spend the extra cycle sorting inside and outside the
cycle report - which, since we are in a failure state anyway, seems like a
reasonable use of CPU cycles in return for consistent results.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>