Use sort_by_cached_key when sorting candidate issuers (#15355)

find_potential_parents sorts candidates with a key function that re-parses
the candidate's extensions (fresh allocation + linear DER re-parse) on
every comparison, i.e. O(n log n) parses. sort_by_cached_key computes the
key once per candidate.

Benchmark (verify a leaf against a store of N same-DN CAs — the
adversarial name-collision case the sort exists for; Linux x86-64,
CPython 3.11, release build, min of 7 timeit repeats):

    N=4:     102.5 us -> 98.4 us
    N=32:    176.5 us -> 117.2 us  (1.5x)
    N=100:   359.9 us -> 151.1 us  (2.4x)


Claude-Session: https://claude.ai/code/session_01C5bsKENedjVD9gcLApf1x4

Co-authored-by: Claude <noreply@anthropic.com>