Don't set Guard Pages Before GCD Sync is Complete

Description

There's a window between when the CPU Arch Protocol is published
and the GCD sync is complete where guard pages could be set on allocated
memory and unset on freed memory. These operations should not be done
until the GCD sync is complete or some free memory may have
EFI_MEMORY_RP applied before the memory protection logic expects.

- [x] Impacts functionality?
  - **Functionality** - Does the change ultimately impact how firmware functions?
  - Examples: Add a new library, publish a new PPI, update an algorithm, ...
- [x] Impacts security?
  - **Security** - Does the change have a direct security impact on an application,
    flow, or firmware?
  - Examples: Crypto algorithm change, buffer overflow fix, parameter
    validation improvement, ...
- [ ] Breaking change?
  - **Breaking change** - Will anyone consuming this change experience a break
    in build or boot behavior?
  - Examples: Add a new library class, move a module to a different repo, call
    a function in a new library class in a pre-existing module, ...
- [ ] Includes tests?
  - **Tests** - Does the change include any explicit test code?
  - Examples: Unit tests, integration tests, robot tests, ...
- [ ] Includes documentation?
  - **Documentation** - Does the change contain explicit documentation additions
    outside direct code modifications (and comments)?
  - Examples: Update readme file, add feature readme file, link to documentation
    on an a separate Web page, ...

How This Was Tested

Tested by running the DxePagingAuditTestApp on Q35 and SBSA platforms.
Additionally tested by booting to Windows on Q35.

Integration Instructions

N/A

MdeModulePkg/Core/Dxe/Mem/HeapGuard.c

@@ -537,7 +537,11 @@ SetGuardPage (
 {
   EFI_STATUS  Status;
 
-  if (gCpu == NULL) {
+  // MU_CHANGE: Because the memory protection initialization routine
+  //            is no longer triggered by the CPU arch protocol, check
+  //            if the initialization routine has run before allowing
+  //            this function to execute.
+  if ((gCpu == NULL) || !mGcdSyncComplete) {
     return;
   }
 
@@ -573,7 +577,11 @@ UnsetGuardPage (
   UINT64      Attributes;
   EFI_STATUS  Status;
 
-  if (gCpu == NULL) {
+  // MU_CHANGE: Because the memory protection initialization routine
+  //            is no longer triggered by the CPU arch protocol, check
+  //            if the initialization routine has run before allowing
+  //            this function to execute.
+  if ((gCpu == NULL) || !mGcdSyncComplete) {
     return;
   }