fix(build): pin @strapi/sdk-plugin to ^5.4.0 — v6 produces broken 23-line stub bundles

CRITICAL: the last published version (4.5.9) is unusable. The
dist/server/index.js tarball entry is only 23 lines of re-exports
pointing to submodules that are NOT in the tarball. Any consumer
installing 4.5.9 crashes at strapi boot with
  Error: Cannot find module './register'

Root cause: @strapi/sdk-plugin v6 (bumped a few releases ago) ships
a new build pipeline that does NOT recursively inline
require('./submodule') imports from the entry point. v5's pack-up
bundled the entire transitive tree into one file; v6 leaves every
first-level require as a bare re-export to a path that is not in
files and not resolvable at runtime. The stub passes
strapi-plugin verify (exports resolve OK) but ships zero code.

Rolled @strapi/sdk-plugin back to ^5.4.0 (v5 toolchain, explicitly
documented as still supported in the v6 upgrade guide). Added a
tracked lockfile via npm install --no-workspaces so CI npm ci
resolves the same tree.

Verified locally: fresh bundle is 52,004 lines (all deps inline),
strapi-plugin verify passes cjs and esm export resolution, dist
starts with real runtime imports instead of the ./register stub.

After this lands, semantic-release will cut 4.5.10. The broken
4.5.9 should be npm deprecated manually with a pointer to 4.5.10.

Author: Schero94