fix: recompile course-updater workflow with gh-aw v0.68.1

The 'Course Updater' agentic workflow was failing because both the
'github' and 'safeoutputs' MCP servers were blocked by a Copilot CLI
policy change. The old lock file (compiled with gh-aw v0.64.4) used
'latest' for the Copilot CLI version, which pulled a newer CLI that
introduced MCP policy enforcement breaking the MCP server connections.

Key changes from recompilation:
- Pin Copilot CLI to v1.0.21 (instead of floating 'latest')
- Upgrade AWF firewall from v0.25.4 to v0.25.18
- Upgrade MCP Gateway from v0.2.9 to v0.2.17
- Update gh-aw-actions to v0.68.1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: DanWahlin

.github/aw/actions-lock.json

@@ -5,10 +5,15 @@
       "version": "v8",
       "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
     },
-    "github/gh-aw-actions/setup@v0.64.4": {
+    "actions/github-script@v9": {
+      "repo": "actions/github-script",
+      "version": "v9",
+      "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
+    },
+    "github/gh-aw-actions/setup@v0.68.1": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.64.4",
-      "sha": "7cae8cd356c7905aeda72eb08e1d0b4501310c23"
+      "version": "v0.68.1",
+      "sha": "2fe53acc038ba01c3bbdc767d4b25df31ca5bdfc"
     }
   }
 }