CookieJar improvements

While looking through #7577, we found a few details that could possibly be improved.

- [ ] It should really output duplicate cookies in the Cookie header (e.g. when cookies with different paths have the same name) to match the recommended behaviour in the spec. This may be fairly complex to refactor, as the cookies/morsels used from http.cookies don't seem to support this. Upon reviewing the documentation, I get the impression that http.cookies is intended for server-side, while http.cookiejar is intended for client-side. So, we may need to replace http.cookies to support this behaviour.
- [ ] Cookies are now ordered by path length, but it should also use creation timestamp as a tie-breaker (point 2: https://www.rfc-editor.org/rfc/rfc6265.html#section-5.4). This is probably most relevant if cookies with the same name and path match (but different domains, like a root domain and subdomain). I don't think we currently store creation timestamp, so we'd probably need to add this.
- [x] (#7944) .filter_cookies() currently just iterates over all cookies and checks each one if they are valid. This could be made more efficient because they are stored like `self._cookies[(domain, path)][name]`, therefore we could do domain-matching and path-matching on the keys, instead of testing every single cookie. https://github.com/aio-libs/aiohttp/blob/4639b36852f3b4939e61311d7863f1d7450d500d/aiohttp/cookiejar.py#L141-L142