Add a diagnostics job for the label syncing workflow

[jsf9k]

Also add a runner hardening task to the labeler job.

🗣 Description

This pull request adds a diagnostics job to the sync-labels.yml workflow. It also adds a runner hardening task to the labeler job in that workflow.

💭 Motivation and context

This agrees with the changes we made to the build.yml workflow in #144. I believe such changes should be made globally to all of our workflows, with the goal of eventually changing the runner hardening task to enforce (as opposed to audit) the hardening rules.

🧪 Testing

All automated tests pass. I examined the results of the workflow runs with my ocular orbs.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[mcdonnnj]

Makes sense and I was having a similar thought 👍

[dav3r]

👍 👍