High CPU load after upgrade to v2.22

### Jenkins and plugins versions report

Environment

```text
Jenkins: 2.541.1
OS: Linux - 4.18.0-553.104.1.el8_10.x86_64
Java: 17.0.18 - Red Hat, Inc. (OpenJDK 64-Bit Server VM)
---
Office-365-Connector:5.2.0
absint-astree:115.v23dc31226ea_8
analysis-model-api:13.18.0-935.v784ca_107400a_
ansicolor:536.v13fa_b_860c267
ant:520.vd082ecfb_16a_9
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
apache-httpcomponents-client-5-api:5.6-183.ve5a_8a_b_e71e59
artifactory:4.0.8
artifactory-client-api:2.19.0-116.vc6e7efff0e6b_
asm-api:9.9.1-189.vb_5ef2964da_91
audit-trail:436.vc0d1e79fc5a_3
authentication-tokens:1.144.v5ff4a_5ec5c33
aws-credentials:254.v978a_5e206a_d7
aws-java-sdk-ec2:1.12.780-480.v4a_0819121a_9e
aws-java-sdk-minimal:1.12.780-480.v4a_0819121a_9e
aws-java-sdk2-core:2.33.4-62.vc1a_8df64b_4c9
aws-java-sdk2-ec2:2.33.4-62.vc1a_8df64b_4c9
azure-ad:631.vb_2d4d8cc86b_0
azure-credentials:418.v6628eec6a_2c5
azure-sdk:259.vf079c96088a_f
basic-branch-build-strategies:317.v85b_331d6cc42
bootstrap5-api:5.3.8-895.v4d0d8e47fea_d
bouncycastle-api:2.30.1.82-277.v70ca_0b_877184
branch-api:2.1280.v0d4e5b_b_460ef
build-blocker-plugin:171.ve0716a_f69636
build-discarder:158.vce570d01ce4c
build-monitor-plugin:1.14-985.v7b_f37b_3d0b_f5
build-user-vars-plugin:212.vd6b_e9f6d0cdb_
build-with-parameters:81.ve4a_9c2499d9a
caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81
checks-api:402.vca_263b_f200e3
cloud-stats:377.vd8a_6c953e98e
cloudbees-bitbucket-branch-source:937.2.4
cloudbees-disk-usage-simple:256.v20ec4eb_884f1
cloudbees-folder:6.1079.vc0975c2de294
command-launcher:123.v37cfdc92ef67
commons-collections4-api:4.5.0-8.va_d5448ef9011
commons-compress-api:1.28.0-2
commons-httpclient3-api:3.1-3
commons-lang3-api:3.20.0-109.ve43756e2d2b_4
commons-text-api:1.15.0-210.v7480a_da_70b_9e
conditional-buildstep:1.5.0
config-file-provider:1006.vc7366c201f57
copyartifact:795.ve8e151429b_27
coverage:2.3139.v731d2e83ea_8a_
credentials:1488.v9049e8c8b_d98
credentials-binding:717.v951d49b_5f3a_a_
custom-folder-icon:2.938.vb_42c40c33ea_5
dark-theme:574.va_19f05d54df5
dashboard-view:2.558.v96b_901978e47
data-tables-api:2.3.5-1497.v38449eb_7d5a_1
dependency-check-jenkins-plugin:5.6.2
dependency-track:6.0.2
display-url-api:2.217.va_6b_de84cc74b_
docker-commons:457.v0f62a_94f11a_3
docker-java-api:3.7.0-133.v93b_8fb_c17a_77
docker-plugin:1308.vff6e33248305
docker-workflow:634.vedc7242b_eda_7
dtkit-api:3.0.3
durable-task:651.v1f5e074fc83f
echarts-api:6.0.0-1165.vd1283a_3e37d4
eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
email-ext:1933.v45cec755423f
emoji-symbols-api:17.0-57.v8d44b_9a_b_d5ea_
envinject:2.934.vc674e76cf954
envinject-api:1.237.v82803a_511906
extended-choice-parameter:388.ve7b_d0b_920e10
extended-read-permission:68.vd270568a_7520
external-monitor-job:223.vb_fddcf42c9b_3
extra-columns:1.28
favorite:2.263.v941d21defef7
file-operations:409.v90cc23075442
file-parameters:425.v3fa_801681b_5e
flatpickr-api:4.6.13-32.v60a_51029c136
font-awesome-api:7.1.0-882.v1dfb_771e3278
forensics-api:3.1832.va_1179842528b_
generic-webhook-trigger:2.4.1
git:5.10.0
git-client:6.5.0
git-forensics:3.2274.v3dc0fd546572
git-parameter:462.vdcf3df2ed2ca_
github:1.46.0
github-api:1.330-492.v3941a_032db_2a_
github-branch-source:1967.vdea_d580c1a_b_a_
github-checks:634.v371dc6d978a_3
gradle:2.18.1203.v2c96b_1243c72
groovy:497.v7b_061a_a_de65d
gson-api:2.13.2-173.va_a_092315913c
handy-uri-templates-2-api:2.1.8-38.vcea_5d521d5f3
htmlpublisher:427
http_request:1.24
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
jackson2-api:2.20.1-423.v13951f6b_6532
jakarta-activation-api:2.1.4-1
jakarta-mail-api:2.1.5-1
jakarta-xml-bind-api:4.0.6-12.vb_1833c1231d3
javadoc:354.vee1a_660b_4990
javax-activation-api:1.2.0-8
javax-mail-api:1.6.2-11
jaxb:2.3.9-143.v5979df3304e6
jdk-tool:83.v417146707a_3d
jersey2-api:2.47-165.ve7809a_3e87e0
jfrog:1.5.10
jira:3.21
jjwt-api:0.11.5-120.v0268cf544b_89
job-restrictions:0.8
jobConfigHistory:1363.v21c3d9642e9a_
jobcacher:816.vb_582c458726f
jobcacher-artifactory-storage:218.vb_b_f388660e8b_
jobcacher-azure-storage:33.vd1d60ffa_d4ee
joda-time-api:2.14.0-177.vd7e9347b_e7d5
jquery:1.12.4-3
jquery3-api:3.7.1-619.vdb_10e002501a_
jsch:0.2.16-95.v3eecb_55fa_b_78
json-api:20251224-185.v0cc18490c62c
json-path-api:2.10.0-202.va_9cc16c1e476
jsoup:1.22.1-76.v9cdb_2456c0e3
junit:1396.v095840ed8491
kubernetes:4423.vb_59f230b_ce53
kubernetes-client-api:7.3.1-256.v788a_0b_787114
kubernetes-credentials:207.v492f58828b_ed
ldap:807.v7d7de30930cf
leastload:62.vfa_8830902733
list-git-branches-parameter:0.0.13
locale:614.va_6a_5a_1a_f2b_38
localization-support:1.41.v186a_c1569458
lockable-resources:1438.v3c0f8c9e2060
mailer:525.v2458b_d8a_1a_71
mask-passwords:212.v4967a_a_73b_506
material-theme:0.5.2-rc100.6121925fe229
matlab:1106.v9b_fb_b_7b_29b_5f
matrix-auth:3.2.9
matrix-project:870.v9db_fcfc2f45b_
maven-plugin:3.27
metrics:4.2.37-494.v06f9a_939d33a_
mina-sshd-api-common:2.16.0-167.va_269f38cc024
mina-sshd-api-core:2.16.0-167.va_269f38cc024
monitoring:2.6.0
msbuild:1.38
netty-api:4.1.130.Final-21.v5a_db_3eb_ea_034
next-executions:517.vc2c2ca_1b_c808
nodejs:1.6.6
nord-theme:1.1
nuget:1.1
oidc-provider:111.v29fd614b_3617
okhttp-api:4.12.0-195.vc02552c04ffd
oss-symbols-api:442.v99039087229b_
parameterized-scheduler:378.va_234d1c44456
parameterized-trigger:873.v8b_e37dd8418f
parasoft-findings:10.7.6
people-view:1.16.v774d3b_4b_3a_f3
piketec-tpt:9.7
pipeline-agent-build-history:142.v3046581ceb_71
pipeline-build-step:584.vdb_a_2cc3a_d07a_
pipeline-github:2.8-162.382498405fdc
pipeline-graph-analysis:254.v0f63a_a_447dca_
pipeline-graph-view:777.vdeb_113b_b_94da_
pipeline-groovy-lib:787.ve2fef0efdca_6
pipeline-input-step:540.v14b_100d754dd
pipeline-milestone-step:138.v78ca_76831a_43
pipeline-model-api:2.2277.v00573e73ddf1
pipeline-model-definition:2.2277.v00573e73ddf1
pipeline-model-extensions:2.2277.v00573e73ddf1
pipeline-rest-api:2.39
pipeline-stage-step:322.vecffa_99f371c
pipeline-stage-tags-metadata:2.2277.v00573e73ddf1
pipeline-stage-view:2.39
pipeline-utility-steps:2.20.0
plain-credentials:199.v9f8e1f741799
plain-text-console-link:9.vd340b_6d6312a_
plot:2.4.0
plugin-usage-plugin:4.10
plugin-util-api:6.1192.v30fe6e2837ff
powershell:2.3
prism-api:1.30.0-703.v116fb_3b_5b_b_a_a_
prometheus:852.v317db_5d17a_b_0
pubsub-light:1.19
resource-disposer:0.25
robot:6.2.0
run-condition:276.v97298f3a_cd51
scm-api:728.vc30dcf7a_0df5
script-security:1399.ve6a_66547f6e1
simple-theme-plugin:230.v8b_fd91b_b_800c
snakeyaml-api:2.5-149.v72471e9c6371
sonar:2.18.2
splunk-devops:1.11.2
sse-gateway:1.29
ssh-agent:386.v36cc0c7582f0
ssh-credentials:361.vb_f6760818e8c
ssh-slaves:3.1096.v0b_cc466e4323
ssh-steps:2.0.92.vb_a_0583935f9b_
sshd:3.384.vc89b_5e138cf9
structs:362.va_b_695ef4fdf9
theme-manager:327.v780d7096ec29
thinBackup:2.1.3
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.284.v1974ea_324382
uipath-automation-package:6.1.340.v334e605fb_d20
uno-choice:2.8.5
validating-string-parameter:255.v31e2e6d0d273
variant:70.va_d9f17f859e0
versioncolumn:400.v3c5c3004f31d
warnings-ng:12.10011.va_027181d7658
windows-azure-storage:535.v20d12167fa_70
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1398.v67030756d3fb_
workflow-basic-steps:1098.v808b_fd7f8cf4
workflow-cps:4255.vd9c37f80fd8a_
workflow-durable-task-step:1464.v2d3f5c68f84c
workflow-job:1571.vb_423c255d6d9
workflow-multibranch:821.vc3b_4ea_780798
workflow-scm-step:466.va_d69e602552b_
workflow-step-api:710.v3e456cc85233
workflow-support:1015.v785e5a_b_b_8b_22
ws-cleanup:0.49
xunit:3.1.6
```

### What Operating System are you using (both controller, and any agents involved in the problem)?

Controller
Linux (redhat 8.10)

Agents not involved.

### Reproduction steps

It is somewhat difficult to specify the exact configuration needed to reproduce this behavior. We have a hypothesis about the cause, but this [PR](https://github.com/jenkinsci/custom-folder-icon-plugin/pull/502/changes) seems to be the root cause.

Jenkins Server stats:
- 1000 Users - most users from europe
- 20k Builds daily

After the LTS Upgrade to Version **2.541.1** and the update of the plugin from **v2.21 to 2.938.vb_42c40c33ea_5**. We noticed a significant higher load on our cpu.

_Screenshots: timezone GMT+1_

**Normal day before the update**

**Normal day after the update**

Around ±20 users appear to have been specifically affected by the change, which likely caused the higher load. This was evident as the Jenkins UI became nearly unusable for these users, with every HTTP request loading times ranging from 10 to 60 seconds. The overall performance was also effected but not comparable.

We executed the following script on our Jenkins server around 15:00
```import hudson.ExtensionList

def contributorClass = Class.forName("jenkins.security.csp.Contributor")
def extensions = ExtensionList.lookup(contributorClass)

def toRemove = extensions.find {
it.getClass().getName() == 'jenkins.plugins.foldericon.UrlFolderIcon$UrlFolderIconContributor'
}

if (toRemove != null) {
extensions.remove(toRemove)
println "Removed: ${toRemove.getClass().getName()}"
} else {
println "UrlFolderIconContributor not found"
}
```

The CPU load aftewards

Directly after the exeuction we and the affected users had a improved performance.

### Expected Results

Not a higher CPU load

### Actual Results

Higher CPU load

### Anything else?

_No response_

### Are you interested in contributing a fix?

Unfortunately, I can only provide the data. Our understanding is that the affected user has various folder permissions with the plugin "matrix-project:870.v9db_fcfc2f45b_" shared across the server. Some folders have inheritance enabled, while others have it disabled - which caused UrlFolderIconContributor to check everytime every permission on every level.
Another workaround was to promote the one of the affected users to the 'Overall - Administer' role. We tried different permission settings but nothing worked excecpt of this role.

Start by reviewing PR 502 and the jenkins.plugins.foldericon.UrlFolderIcon$UrlFolderIconContributor referenced in the report. Reproduce the behavior with folder permissions that mix inheritance settings, then inspect the contributor through the ExtensionList lookup script. Done means confirming that affected users no longer cause excessive CPU load or slow UI requests without requiring Overall/Administer access.

Written by the indexing model from the issue text.