.sync: Fix Mu DevOps version in Mu workflows

Project Mu repos have "leaf" workflows. These are workflow files
that wrap around reusable workflows in mu_devops.

Currently, a leaf workflow uses the reusable workflow from the latest
commit in `mu_devops/main`.

This means the version of mu_devops is "floating" in that the leaf
workflows immediately pick up the latest change. To improve build
traceability and stability, this change moves the "leaf" workflow
files to use fixed/release versions of content in the mu_devops repo.

This change updates all leaf workflow files to use the version
specified in one place - `.sync/Version.njk`. That version will be
substituted in the leaf workflow file during the file sync process to
downstream repos.

Example flow:
  1. Make a new Mu DevOps release (e.g. "v1.0.0")
  2. Update `.sync/Version.njk` to set `mu_devops` to `"v1.0.0"`

Step (2) causes the following automated actions to take place after
the change is merged into `mu_devops/main`:
  1. All sync files (e.g. a leaf workflow file) that depend on
     this version get the new value substituted
  2. All sync files with the substituted value are synced to their
     respective repos (PRs created with the change)
  3. After the PRs in those repos are merged, they use the new
     version of Mu DevOps in their pipelines

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Author: makubacki

.sync/Files.yml

@@ -274,6 +274,7 @@ group:
   - files:
     - source: .sync/workflows/leaf/label-issues.yml
       dest: .github/workflows/label-issues.yml
+      template: true
     - source: .sync/workflows/config/label-issues/file-paths.yml
       dest: .github/workflows/label-issues/file-paths.yml
     - source: .sync/workflows/config/label-issues/regex-pull-requests.yml
@@ -298,6 +299,7 @@ group:
   - files:
     - source: .sync/workflows/leaf/label-sync.yml
       dest: .github/workflows/label-sync.yml
+      template: true
     repos: |
       microsoft/mu
       microsoft/mu_basecore
@@ -319,6 +321,7 @@ group:
   - files:
     - source: .sync/workflows/leaf/stale.yml
       dest: .github/workflows/stale.yml
+      template: true
     repos: |
       microsoft/mu
       microsoft/mu_basecore
@@ -341,6 +344,7 @@ group:
   - files:
     - source: .sync/workflows/leaf/stale.yml
       dest: .github/workflows/stale-leaf.yml
+      template: true
     repos: |
       microsoft/mu_devops
 

.sync/workflows/leaf/label-issues.yml

@@ -14,6 +14,8 @@
 # SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 
+{% import '../../Version.njk' as sync_version -%}
+
 name: Apply Issue and PR Labels
 
 on:
@@ -31,4 +33,4 @@ on:
 
 jobs:
   apply:
-    uses: microsoft/mu_devops/.github/workflows/Labeler.yml@main
+    uses: microsoft/mu_devops/.github/workflows/Labeler.yml@{{ sync_version.mu_devops }}

.sync/workflows/leaf/label-sync.yml

@@ -13,6 +13,8 @@
 # SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 
+{% import '../../Version.njk' as sync_version -%}
+
 name: Sync GitHub Labels
 
 on:
@@ -24,4 +26,4 @@ on:
 
 jobs:
   sync:
-    uses: microsoft/mu_devops/.github/workflows/LabelSyncer.yml@main
+    uses: microsoft/mu_devops/.github/workflows/LabelSyncer.yml@{{ sync_version.mu_devops }}

.sync/workflows/leaf/stale.yml

@@ -13,6 +13,8 @@
 # For more information, see:
 # https://github.com/actions/stale
 
+{% import '../../Version.njk' as sync_version -%}
+
 name: Check for Stale Issues and Pull Requests
 
 on:
@@ -24,4 +26,4 @@ on:
 
 jobs:
   check:
-    uses: microsoft/mu_devops/.github/workflows/Stale.yml@main
+    uses: microsoft/mu_devops/.github/workflows/Stale.yml@{{ sync_version.mu_devops }}