Bump firewall to v0.27.6 and mcpg to v0.3.27

## Summary

Bump the pinned default versions in `pkg/constants/version_constants.go`:

| Constant | Current | New |
|---|---|---|
| `DefaultFirewallVersion` | `v0.27.4` | `v0.27.6` |
| `DefaultMCPGatewayVersion` | `v0.3.26` | `v0.3.27` |

## Releases

- **gh-aw-firewall v0.27.6** — https://github.com/github/gh-aw-firewall/releases/tag/v0.27.6
- **gh-aw-mcpg v0.3.27** — https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.27

## Why

- **Firewall v0.27.6** notably fixes the api-proxy **AIC=0 token-usage regression** (the `token-tracker-shared.js` / OTEL modules were missing from the api-proxy Docker image COPY list, silently disabling all token tracking) and the Copilot cache-write token fidelity accounting.

## Changes required

1. Update `pkg/constants/version_constants.go`:
- `DefaultFirewallVersion` → `v0.27.6`
- `DefaultMCPGatewayVersion` → `v0.3.27`
2. Re-pin container image digests (firewall agent/squid/api-proxy/cli-proxy and the mcpg image) wherever digests are recorded (`pkg/workflow/data/action_pins.json` / `pkg/actionpins/data/action_pins.json`, lock files).
3. Recompile workflows so `.lock.yml` files pick up the new image tags + digests.
4. Add a changeset (e.g. `.changeset/patch-bump-awf-v0-27-6-mcpg-v0-3-27.md`) following the existing naming convention.
5. Run tests (`pkg/constants/spec_test.go`, firewall pin compile tests) to validate.