cyberdefence, I'll try to answer your questions or at least point you in the right direction:
1) If you are using a Standard license now, then a ColdFusion 11 Standard license might be adequate. However, since you will be installing it on a virtual machine, keep in mind that the CF11 EULA licensing terms put very specific limitations on how many cores you can assign to that virtual machine (specifically, pay particular attention to sections 1.20, 1.21, and 188.8.131.52(c). It's possible that you may have to purchase an Enterprise license if your application requires more processing power than the EULA allows for a Standard license.
2) There are no client licenses for ColdFusion, as licensing is tied to the server configuration, not the number of client connections/users. You just have to make sure you have adequate licenses to meet the hardware demand of your application (see #1 above).
3a) I wouldn't waste time incrementally trying your code on CF9, CF10 and CF11, just test and fix against CF11. Install a CF11 Developer Edition license on your local machine (recommended) and/or on the server that will eventually be put into production. Copy your code there, and begin testing and refining your code to run on CF11. If you put Developer Edition on your server, once your code is fully tested/fixed, just go into ColdFusion Administrator and fill in the serial number for your production CF11 license.
3b) Yes, you might have to refactor/rewrite the non-ColdFusion stuff too.
3c) Usually, you can jump straight from SQL 2005 to the latest version officially supported by ColdFusion 11 (I think that's SQL Server 2012) without progressively upgrading the various versions in between. If you backup the database and restore it to a new SQL 2012 instance, it will by default be in SQL 2005 compatibility level (so newer features won't be enabled until you change the compatibility level to SQL 2012. The only hiccup to that I can think of is if you have custom functions or stored procedures that call native functions that were subsequently deprecated and removed. But doing a backup of the database and restoring it on a test SQL 2012 Express instance, then testing any custom functionality should identify if you have any functions/stored procedures that need to be modified. If you've been using SQL Express 2005 and it has met the performance demands of your application, than SQL Express 2012 likely will too as it has raised the hardware throttling limits (CPU cores, max memory, max database size). However, consider putting the SQL Express instance on a separate virtual machine from ColdFusion, especially if you have to restrict the number of CPU cores to meet the ColdFusion Standard EULA terms.
3d) Yes, but that is fairly easily done. If your servers operate on a Windows domain, make sure that you run the ColdFusion service under a domain account (see the ColdFusion 11 Lockdown Guide for recommendations), and make sure that domain account is granted the required permissions to your database in SQL Server. Otherwise, if you choose to use a SQL Login dedicated for your ColdFusion server, use that login when you configure the data source. Pay close attention when you install SQL Server as it disables SQL Logins by default (Microsoft's preference is to use Windows security rather than SQL Server security). You will also likely need to enable TCP/IP protocol for your SQL Server instance in SQL Server Configuration Manager (this is a common oversight that pops up on the forums frequently when folks can't get ColdFusion to connect to the database properly).
If you have follow up questions, please post them here. If you get started and run into specific issues getting your servers configured or your code working, please start a new thread for those so the discussions can remain on-point.