ua,server: carefully reduce usage of `tenant 2` as an application tenant in tests

This issue is a sub-issue of https://github.com/cockroachdb/cockroach/issues/151327

There are around 31 usages of `roachpb.MustMakeTenantID(2)` in tests used for application tenant. We should be replacing them with tenant id 3. This would align with real world scenario where tenant with id 2 doesn't exist, which is enforced in demo cluster and normal operations. And if a cluster goes through UA migration, tenant 2 would be a system tenant.

This separate sub-issue is for our peace of mind, if we might have breached the boundaries of the tenants' keyspaces or if we might have changed the tests such that `tenant 2` is losing any coverage, which we don't want to happen.

Jira issue: CRDB-53185