Add aaz agentmesh extension command models

[Kshitija Murudi (kmurudi)]

Summary

Adds AAZ command models for az agentmesh (Microsoft.NetworkSecurity, API version 2026-07-21-preview), covering the management-plane commands for Agent Mesh fabrics, nested fabric members, and policy groups.

These models back the corresponding agentmesh Azure CLI extension.

Command tree

• agentmesh fabric create / update / show / delete / list
• agentmesh fabric member create / update / show / delete / list
• agentmesh policy-group create / update / show / delete / list

Design notes

• Fabric and policy-group list support both subscription and resource-group scopes through optional --resource-group / -g, mapping to the corresponding ARM list operations.
• Members remain nested beneath their parent fabric and use --fabric-name plus --member-name.
• Create, update, and delete preserve the service's long-running operation semantics; updates use the tags-only PATCH operations defined by the API.
• Member create supports both workload discriminators: Azure Container Instances (aci) and Agent Fabric Sandbox (agent-fabric-sandbox).
• Policy-group create supports all five network-security policy discriminators: FQDN filtering, URL filtering, MCP, TLS inspection, and content inspection.
• Provider/internal Operations_List and OperationStatus_Get endpoints are intentionally excluded from the customer command surface.

Testing

• aaz-dev command-model verify --aaz-path <aaz-repo> --target agentmesh — passed.
• PR Verify Metadata workflow — passed.
• Generated agentmesh extension tests — 3 passed; pylint and flake8 passed.
• Generated create commands for fabric, member, and policy group were submitted to Azure and accepted by the private-preview RP. Backend provisioning did not complete because the RP returned BadGatewayConnection; command serialization and ARM routing were exercised successfully.

The repository-wide verifier currently stops on a pre-existing missing Workloads resource reference from Commands/workloads/_sap-availability-zone-detail.md; targeted Agent Mesh verification is clean and this PR does not modify Workloads.