E2E: TestNodeDrainEphermeralMigrate should work with client ACLs

[tgross]

Our E2E environment doesn't have acls { enabled = true } on the clients, just the servers. If this setting is enabled, the TestNodeDrainEphermeralMigrate fails because the client-to-client ACL check fails and the data isn't migrated. We need to figure out the right client ACL policy to support this. This predates #12267 but I noticed it while working on it.

Note that failure happens silently. The old allocation is simply stopped and the data isn't migrated and the user isn't warned of this, because ephemeral disk migration is best effort. #12267 includes a commit to make the test failure more legible in this case.

[tgross]

Noting that as of #16530 we do have client ACLs enabled, so this test is failing. I'll get this fixed as part of a set of work I'm doing over the next couple weeks about drains.

[tgross]

Example error on the client:

2023-04-06T15:12:28.346Z [WARN] client.alloc_runner.runner_hook.migrate_disk: error migrating data from previous alloc: alloc_id=c2c411f6-942f-0977-62fb-7911d96e4cf3 error="error getting snapshot from previous alloc "b36b3f11-ebfa-a568-27c6-3444c391baa2": Unexpected response code: 403 (Permission denied)"

It turns out the problem with our test is that we don't have sticky=true set, but this means we've been migrating when migrate=true with sticky=false whenever client ACLs are disabled for years. So looking into whether we want to just extend that behavior so that migrate=true implies sticky=true.