1. You don't need any license for HA (cluster).
2. The advanced secure license you need per NX, but most installation don't need this.
3. across controllers, buy on license activated on one NX, shared via cluster. But cluster net to be running, if license device is offline for more than 120 days (I think?) or you reconfigure some stuff in the cluster, license is removed till licensed devices is active again. But never get problems with this.