In which type of physical deployment does a ProxySG have potential visibility to all traffic through the use of a device such as a WCCP-capable router or a Layer 4 switch?