Is there a convention for how to order UTXOs in a transaction with multiple inputs?
The convention is to have the outputs in random order. This is specifically done in an effort to conceal which output is the change output. The change is by default sent to a new address that is owned by the sender, and as such has no history associated with it.

The majority of bitcoin's code is actually c++. Here is a link to the relevant transaction creation code, maybe there are a few comments that could point you in the right direction.