DSO-26217: prepare SDK 1.3.10 release

[robertvangor]

Bump @staffbase/staffbase-plugin-sdk from 1.3.9 to 1.3.10 so the merged DSO-26217 vulnerability fix can be published. The release workflow requires the tag to match package.json, and 1.3.9 is already published.

Only the version fields in package.json and package-lock.json change. npm run build passed on Node 24.19.0.

[review-swarm]

Staffbase AI Code Review

Verdict: ✅ Approved

Diff classified as trivial (≤10 lines, ≤5 files). No reviewers run.

📌 Only the first push is reviewed automatically. After that, comment @swarm review to re-review the latest commit.

• Risk tier: trivial
• Size: XS (trivial to review)
• Head commit: 26ac302
• Findings: 0 critical, 0 warning, 0 suggestions

Findings

No findings.

---

Bot commands

• @swarm ignore <id> [<id>...] — dismiss one or more findings by id (space-separated, including criticals — review each one before dismissing).
• @swarm ignore-all — dismiss every open warning/suggestion (criticals must be dismissed explicitly via ignore <id>).
• @swarm reset-ignores — clear all dismissals on this PR.
• @swarm review — re-run the review against the latest commit.

You can also resolve a non-critical inline conversation to ignore it (and unresolve to bring it back). Resolving a critical conversation is not supported — use ignore <id> instead.

To bypass the entire review (criticals included), apply the break-glass label to the PR.

Execution Steps (3)

1. Filter Diff — ✅ completed
   • Files: 1, +1/-1 lines
2. Reviewer Pipeline — ⏭️ skipped
   • Reason: trivial tier
3. Judge Pass — ⏭️ skipped
   • Reason: trivial tier