preference of 'dry_run' check over certificates and insecure mode checks

Currently in the sessions, dry_run check is after the insecure mode check or the certificates check. However it is not intuitive and mostly not intentional as dry_run should just return the launcher args, container dict or launch string. So it should run even without this. This is observed in Container launcher.

Start with the sessions' Container launcher path, where the issue reports that dry_run is checked after insecure-mode or certificate validation. Trace how launcher arguments, the container dictionary, or launch string are produced, then verify that dry_run returns those values before those checks; add or update the relevant tests if the existing test layout identifies them.

Written by the indexing model from the issue text.