add universe-domain tests

[vchudnov-g]

In #1898 I made a few suggestions for improving test coverage of the user-configured universe domain feature. In order to not delay that PR further, I am strongly leaning towards merging that as soon as the presubmits with the latest changes pass, and implementing the testing suggestions in a follow-up PR. The suggestions are:

• [ ] TODOs listed in /tests/system/{conftest,test_universe_domain}.py in #1898
• [ ] adding additional fixtures for configured universe possibilities
• [ ] adding a testcase where we provide both cert_source and `"never"
• [ ] adding a testcase where env is empty
• [ ] testing combinations of client certificate, mTLS endpoint, api_endpoint
• [ ] factoring out tests that don't have universe domain

To be clear: we should make the tests as small as they can be (e.g. preferring unit tests to integration tests), and we should check whether the suggestions above have been already covered in other tests elsewhere in the codebase than where I made the comments above (I suspect in some cases that may be the case).