chore(PocketIC): deterministic registry and validation

[mraszyk]

This PR fixes the PocketIC registry to be deterministic for newly created instances and when instances are restarted from a previous state. This fact is also validated when restarting an instance (which fails if the newly created registry does not match the previous registry serialized to disk).

The determinism is achieved by:

• sorting canister ranges of a subnet before deriving its seed;
• creating TLS certificates from deterministic (subnet) seeds;
• preserving the order of subnets established by their creation (by using a Vec instead of a BTreeMap).