Extract shared network configuration and environment policy helpers

[copyberry]

Extract shared network configuration and environment policy helpers

What changed

• Introduce PreparedNetworkConfig to separate proxy preparation from applying managed network requirements, preserving preparation before permission fallback in local configuration loading.
• Add helpers to build portable environment policies, retain selected or managed policies even when the proxy is disabled, and validate policies against the final permission profile using the execution resolver.
• Strip listener addresses from environment network configuration and reject unsupported settings, malformed domain patterns, and invalid Unix socket paths.
• Expose supporting managed-feature and permission-profile configuration helpers.

Testing

Add coverage for policy retention, listener removal, unsupported and malformed policies, and validation against permission profiles. Strengthen configuration tests to compare rebuilt proxy specifications and verify proxy configuration survives permission fallback.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}