Network namepaces "none" fails on machines/clusters without user namespaces

Some of the clusters I work with have recently disabled user namespaces due to various CVEs floating around, which causes Apptainer calls to crash on the network aspect with

```
Failed to create network namespace: maximum number of network namespaces exceeded, check /proc/sys/user/max_net_namespaces
```

even the else clause setting it to none here

https://github.com/common-workflow-language/cwltool/blob/0d73bb054b77a09aa12ccd5b902d3de3898ce8dd/cwltool/singularity.py#L653-L657

triggers it (I have verified the issue with a simple direct call to `apptainer --net none ....`), but simply removing the else clause such that the `--net` option is not passed at all fixes it.

I'm not sure what the best avenue is here. From what I gather, setting it to `none` is good for isolation compared to not setting it, but although patching singularity.py myself gets me around it for the time being, it doesn't feel like the greatest long-term solution.

Inspect cwltool/singularity.py around lines 653-657 and reproduce the failure with Apptainer on a machine where user namespaces are disabled. Compare invocation with and without --net none, then add coverage for the affected path; done means cwltool no longer crashes in that environment while preserving the intended network isolation behavior where supported.

Written by the indexing model from the issue text.