[SFI] Apply CFSClean policy explicitly in the pipeline template

[raych1]

• Updated the networkIsolationPolicy setting from Permissive to Permissive, CFSClean in 1es-redirect.yml

The Java pipelines are already compliant with the CFSClean policy, and this PR makes it applied to source code. We are not compliant with CFSClean2 and CFSClean3 policies. The CFSClean2 violation come from outreach to docker hub, and the CFSClean3 violations come from outreach to package.confluent.io. I'm working with Cosmos team and 1ES team on the mitigations.

Test runs
template: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6372605&view=results
spring: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6372601&view=results
cosmos: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6372590&view=results

[Copilot]

Pull request overview

This PR updates the shared 1ES redirect pipeline template to explicitly apply the CFSClean network isolation policy alongside the existing permissive policy.

Changes:

• Adds CFSClean to networkIsolationPolicy for Java pipelines.
• Leaves the pipeline template structure and SDL settings otherwise unchanged.