Fix remaining CFS policy violations

[Miller Wang (wangmingliang-ms)]

Summary

• route ManifestGeneratorTask Maven component detection through authenticated vscjava CFS settings
• download and checksum-verify the pinned Gradle 9.0 distribution from a vscjava Universal Package instead of services.gradle.org
• resolve Microba through CFS in CI while preserving the existing Atlassian repository for local developer builds

Root cause

Build 31919047 reported:

• CFSClean: 11 repo.maven.apache.org connections from ManifestGeneratorTask
• CFSClean2: 1 Gradle wrapper distribution connection to services.gradle.org
• CFSClean3: 2 Atlassian redirect connections for Microba

Validation

• full pipeline-equivalent local build passed: Maven Utils + internal Gradle clean buildPlugin
• Manifest Maven child simulation recorded POM/JAR provenance as vscjava
• pinned Gradle ZIP SHA-256: 8fad3d78296ca518113f3d29016617c7f9367dc005f932bd9d93bf45ba46072b
• Microba 0.4.4.3 CFS POM/JAR checksums match upstream
• direct request evidence in verification logs: Maven Central 0, Gradle public endpoints 0, Atlassian 0

Remaining validation

• hosted pipeline run and Stop Network Isolation telemetry must confirm CFSClean/CFSClean2/CFSClean3 are all compliant

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.