14198: Use container token for reading input/creating output

14198: Use container token for reading input/creating output

Refactor a bit to make it obvious which token is being used when
communicating with the API server.  Operations that could involve
federated collections (reading the Docker image, reading inputs,
copying remote blocks to local) must use the container token.

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>