Enable CFSClean* policies for extensions-ci-official pipeline

[mmitche]

Enable CFSClean* policies for extensions-ci-official pipeline

This PR adds CFSClean to the networkIsolationPolicy setting in the 1ES Official pipeline template configuration.

Change

-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: Permissive, CFSClean, CFSClean2

Context

• Pipeline: extensions-ci-official (ID: 179)
• Violation: dotnet.exe accessing api.nuget.org during the SourceIndexStage1 job
• Policy: CFSClean (network isolation compliance)
• Reference: dotnet/arcade#16430 (same pattern applied to arcade)

Test Build

• A test build was queued (Build 2929219) but the Build stage was blocked by resource authorization checks (common for manual builds from feature branches). The SDLSources and Correctness stages both completed successfully.
• The change is a single-line addition to the network isolation policy, matching the well-established pattern from the arcade reference commit.

Validation

• YAML syntax verified locally
• Change follows the exact pattern from the arcade reference commit
• The SDLSources and Correctness stages passed in the test build

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Enables the CFSClean network isolation compliance policy for the extensions-ci-official Azure DevOps pipeline by updating the 1ES Official pipeline template settings.

Changes:

• Update networkIsolationPolicy to include CFSClean in addition to existing Permissive and CFSClean2.

---

You can also share your feedback on Copilot code review. Take the survey.

[mmitche]

Looks good in official build.