Expose managed application network requirements - #42417

## What changed

- Add `application.network` managed requirements with exact-domain allow/deny
  rules, default-enabled behavior, domain normalization, and normal managed TOML
  precedence.
- Return the policy separately from agent network requirements through the
  experimental `configRequirements/read` API. The endpoint reports the policy
  but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.

## Testing

- Cover parsing, validation, normalization, layered precedence, and cloud
  requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
  rejection of invalid domains.

GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b