A trusted VPN used across U.S. government networks failed to stop a sophisticated China-linked cyber intrusion, raising urgent questions about supply-chain security, third-party software risks, and the future of government cybersecurity defenses.