fix: pin AWF container images to specific firewall version (#32)

Pull versioned Docker images using bare semver tags (OCI convention)
instead of :latest to ensure reproducible builds, then tag them as
:latest for backward compatibility with AWF.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

templates/base.yml

@@ -193,10 +193,10 @@ jobs:
         displayName: "Download AWF (Agentic Workflow Firewall) v{{ firewall_version }}"
 
       - bash: |
-          docker pull ghcr.io/github/gh-aw-firewall/squid:v{{ firewall_version }}
-          docker pull ghcr.io/github/gh-aw-firewall/agent:v{{ firewall_version }}
-          docker tag ghcr.io/github/gh-aw-firewall/squid:v{{ firewall_version }} ghcr.io/github/gh-aw-firewall/squid:latest
-          docker tag ghcr.io/github/gh-aw-firewall/agent:v{{ firewall_version }} ghcr.io/github/gh-aw-firewall/agent:latest
+          docker pull ghcr.io/github/gh-aw-firewall/squid:{{ firewall_version }}
+          docker pull ghcr.io/github/gh-aw-firewall/agent:{{ firewall_version }}
+          docker tag ghcr.io/github/gh-aw-firewall/squid:{{ firewall_version }} ghcr.io/github/gh-aw-firewall/squid:latest
+          docker tag ghcr.io/github/gh-aw-firewall/agent:{{ firewall_version }} ghcr.io/github/gh-aw-firewall/agent:latest
         displayName: "Pre-pull AWF container images (v{{ firewall_version }})"
 
       {{ prepare_steps }}
@@ -354,10 +354,10 @@ jobs:
         displayName: "Download AWF (Agentic Workflow Firewall) v{{ firewall_version }}"
 
       - bash: |
-          docker pull ghcr.io/github/gh-aw-firewall/squid:v{{ firewall_version }}
-          docker pull ghcr.io/github/gh-aw-firewall/agent:v{{ firewall_version }}
-          docker tag ghcr.io/github/gh-aw-firewall/squid:v{{ firewall_version }} ghcr.io/github/gh-aw-firewall/squid:latest
-          docker tag ghcr.io/github/gh-aw-firewall/agent:v{{ firewall_version }} ghcr.io/github/gh-aw-firewall/agent:latest
+          docker pull ghcr.io/github/gh-aw-firewall/squid:{{ firewall_version }}
+          docker pull ghcr.io/github/gh-aw-firewall/agent:{{ firewall_version }}
+          docker tag ghcr.io/github/gh-aw-firewall/squid:{{ firewall_version }} ghcr.io/github/gh-aw-firewall/squid:latest
+          docker tag ghcr.io/github/gh-aw-firewall/agent:{{ firewall_version }} ghcr.io/github/gh-aw-firewall/agent:latest
         displayName: "Pre-pull AWF container images (v{{ firewall_version }})"
 
       - bash: |