restricted-networking: Add a marker policy for network-isolation migration

* We remove the pre-12 POLICY_REJECT_ALL (network-isolation) since it's
  been replaced with restricted-networking-mode.
* However, if the migration fails, there's no way of knowing, since
  restricted-networking-mode is an allowlist
* Add a new marker policy that is not used anywhere, just so that we
  can debug migration problems easily with
  `adb shell dumpsys netpolicy`
* Can be easily removed later once we know for sure this works well (12L perhaps)

Change-Id: I349eb146d4af935c8ce2d2329ab353d042a319f0