Clarify Tier 3 physical security checks

[sylvesterkaczmarek]

✅ Checklist

• Meaningful title
• Targets develop
• Branch is based on the current target branch

⤴️ Summary

Clarify the Tier 3 physical-security checks so the documentation matches the controls described elsewhere in the checklist.

• remove the absolute statement that connection from outside the secure physical space is impossible
• identify the application gateway NSG, rather than the firewall, as the control whose allowed source IP ranges should be checked
• update the downloadable security-checklist template to match the published guide

🌂 Related issues

Closes #2285.

🔬 Tests

Documentation only.