Is Pokemon's progress saved to the cartridge or the 3DS system it's played on?

Yes. Pokémon games have always and still do save your progress to the physical cartridge, not the console itself.

According to Nintendo, all 3DS games are saved to the cartridges they are played on (unless they are games downloaded from the eShop). The only information saved to the 3DS system itself by some games is StreetPass and SpotPass info.

Pokémon Ultra Moon is no exception, all information is stored on the Game Card.

You can only have one digital copy of a specific game on a console at a time, and it can only have one save file at a time.

Save files for physical copies are stored in the cartridge. As a result, different physical copies have their own saves tied to them, even for the same game.