Include affected npm alpha release in GHSA-f962-v9hr-pfg5

[KSAGlory]

The npm entry for @jupyterlab/git currently sets last_known_affected_version_range to < 0.54.0-a1, excluding that alpha release. Its published lib/components/diff/PlainTextDiff.js still renders header labels through innerHTML. The published 0.54.0 package uses the textContent fix from c6d37b8, and the 0.54.0 release notes list this advisory among the security fixes.

This updates the npm metadata bound to < 0.54.0, consistent with the existing fixed event. The introduced version, Python entries, severity, description, and existing attribution are unchanged.

Evidence:

• Alpha source at tag commit 8443bd5: createHeader assigns the labels to head.innerHTML.
• Upstream fix c6d37b8: renders each label using span.textContent.
• Stable release notes: identify GHSA-f962-v9hr-pfg5 as a security fix.
• Official npm metadata, including archive URLs and integrity hashes: 0.54.0-a1, 0.54.0.

Verification: compared the tagged source and the same compiled function in both published npm archives after validating their registry integrity hashes. The alpha archive contains the vulnerable HTML rendering; the stable archive contains the fix. This was static inspection, without package installation or exploit execution.

The original repository advisory also has the alpha cutoff. This proposal corrects the global npm metadata; it does not update the repository advisory. The earlier change in #9337 addressed the introduced npm version spelling and is preserved here.