arvbox crunch-run and certificate fixes

arvbox crunch-run and certificate fixes

arvbox crunch-run change to -container-enable-networking=default

Previously was "always" which causes CWL tests that checked that
networking was disabled to fail.

arvbox root-cert creates file with .crt instead of .pem, because
that's the file extension update-ca-certificates looks for.

Add cluster id and timestamp to arvbox test certificate common name to
prevents collisions on the certificate subject.

Arvbox sets trusted api_client for workbench2.

refs #15028 refs #15061

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>