Add CFSClean enforcement

[chidozieononiwu]

This pull request updates the pipeline configuration to adjust the network isolation policy for builds. The key change is:

Pipeline configuration:

• Set the networkIsolationPolicy to Permissive, CFSClean in the 1es-redirect.yml pipeline template, which may affect how network access is managed during builds.

https://dev.azure.com/azure-sdk/internal/_build?definitionId=7442

[Copilot]

Pull request overview

Updates the shared 1ES pipeline template to enforce CFSClean network isolation.

Changes:

• Sets networkIsolationPolicy to Permissive, CFSClean.

[raych1]

@heaths this policy enforcement means cargo cannot access these endpoints: index.crates.io, crates.io, static.crates.io.

From the build failures, Rust repo is not ready for it. All the access to these domains would need to redirect to CFS.
CC: @chidozieononiwu

[heaths]

How did all the other steps that pull dependencies work and not Analyze, which also pulls from crates.io?

We can use an internal feed that upstreams - @danieljurek, a couple others, and I have been talking about this lately - but we need a way for public contributions to update or add dependencies if necessary. I'm not suggesting we allow write access to the feed, but @danieljurek had the idea to have a pipeline that - once approved (or maybe manually kicked off?) - could populate the dependencies. I would think this is a problem with every language.

I've already been experimenting with our feed but auth has been a problem. This apparently doesn't allow anonymous pulls, or maybe it's just because nothing has been pulled into it yet so PR #4279 wouldn't work. And to get the credential provider you also need to auth, so what we really need is a way to maybe leave the PR pipelines accessing crates.io and the internal use the feed since we can auth.