Normalize policy JSON before diffing

[mbarbon]

Currently, Astro uses Indent(), which only changes whitespace: Unmarshal+Marshal is necessary for keys to be sorted.

To avoid confusion, the case when old and new policies are the same after normalization still shows the field as modified with an explanatory message, and there is a command-line switch to disable policy diffing.