Possible improvements for `oss-rebuild`

[algomaster99]

1. com.taobao.arthas:arthas-all:3.3.9: fix: parse pom to get the file path of git properties google/oss-rebuild#413 (comment)
2. org.mybatis.spring.boot:mybatis-spring-boot:2.3.0: files with identical content
3. org.simplify4u.plugins:sign-maven-plugin:0.1.0: ordering difference
4. "org.apache.karaf:karaf:4.4.4": it has a KAR file? What is that?