test: enforce cloud engine invariants by default in system tests

[pierugo-dfinity]

There is a registry invariant that enforces that cloud engines must have a free cycles cost schedule. A separate PR will add a second invariant enforcing that cloud engines must contain only type4 node reward types, as this is already how nodes deny incoming connections from cloud engine nodes in the firewall.

This PR ensures those two invariants are satisfied when creating cloud engines in system tests by default (though can still be broken if needed by calling with_cost_schedule/with_node_reward_type).

Moreover, note that this means that it becomes a requirement for any system test running a cloud engine to also have an API BN. As of HEAD, cloud engines already use API BNs to replicate the registry (because NNS nodes' firewall blocks them). Existing system tests using cloud engines work because the nodes' reward types are not set in the registry, thus default to contacting NNS nodes. Soon (draft PR), fetching delegations will also go through API BNs.
This PR thus also adds an API BN to existing tests that use cloud engines.

[github-actions]

This pull request changes code owned by the Governance team. Therefore, make sure that
you have considered the following (for Governance-owned code):

1. Update unreleased_changelog.md (if there are behavior changes, even if they are
   non-breaking).

2. Are there BREAKING changes?

3. Is a data migration needed?

4. Security review?

How to Satisfy This Automatic Review

1. Go to the bottom of the pull request page.

2. Look for where it says this bot is requesting changes.

3. Click the three dots to the right.

4. Select "Dismiss review".

5. In the text entry box, respond to each of the numbered items in the previous
   section, declare one of the following:

• Done.

• $REASON_WHY_NO_NEED. E.g. for unreleased_changelog.md, "No
  canister behavior changes.", or for item 2, "Existing APIs
  behave as before.".

Brief Guide to "Externally Visible" Changes

"Externally visible behavior change" is very often due to some NEW canister API.

Changes to EXISTING APIs are more likely to be "breaking".

If these changes are breaking, make sure that clients know how to migrate, how to
maintain their continuity of operations.

If your changes are behind a feature flag, then, do NOT add entrie(s) to
unreleased_changelog.md in this PR! But rather, add entrie(s) later, in the PR
that enables these changes in production.

Reference(s)

For a more comprehensive checklist, see here.

GOVERNANCE_CHECKLIST_REMINDER_DEDUP

1. Only test changes
2. Only test changes
3. Only test changes, no migration needed
4. No security review either

[pierugo-dfinity]

Now that #9613 is merged, I added a last commit to use API BNs with valid DNS resolution and TLS certificates otherwise the upcoming changes to delegation fetching (#9595) break. Nothing changes conceptually from the original PR description, so I do not expect a new review round.