#213 Cache automatic OpenSSL verify path setup

Summary

• cache truststore's automatic OpenSSL verify-path setup per internal SSLContext
• keep explicit user calls to set_default_verify_paths() user-controlled and unchanged
• add OpenSSL backend unit tests for default paths, capath, fallback cafile, and no-location caching

Why

On OpenSSL 3.0-3.3, repeated automatic calls to set_default_verify_paths() on the same SSLContext can append duplicate CApath lookups. Long-lived clients that reuse one context can then hit quadratic opendir(capath) growth during certificate verification.

This change only deduplicates truststore's automatic pre-wrap configuration. If a caller explicitly invokes SSLContext.set_default_verify_paths(), truststore still passes that through directly.

Fixes #212.

Validation

• PRE_COMMIT_HOME=/private/tmp/truststore-pre-commit-cache /private/tmp/truststore-pr-venv/bin/pre-commit run --all-files
• CI=1 /private/tmp/truststore-pr-venv/bin/nox -s test -- tests/test_openssl.py tests/test_threading.py
  • tests/test_threading.py::test_threading skipped locally because mkcert is not installed
• CI=1 /private/tmp/truststore-pr-venv/bin/nox -s test -- tests/test_api.py::test_trustme_cert tests/test_api.py::test_trustme_cert_loaded_via_capath
• python3 -m compileall -qq -f src/truststore/ tests/test_openssl.py
• Docker remote repro on Debian bookworm / OpenSSL 3.0.20:

handshakes	old capath opens	fixed capath opens
5	35	11
20	440	41
50	2600	101
100	10200	201
200	40400	401