Hackage lists a reachable maintainer address for siren-json

## Summary

`siren-json.cabal`'s `maintainer:` field carries an address that reaches the maintainer, so the contact Hackage publishes for the package works.

## Motivation

`siren-json.cabal:14` still reads `alunduil@alunduil.com`, which no longer reaches the maintainer. Hackage renders that field on the package page as the contact for the package, so anyone with a question, a security report, or a takeover request has no working route.

Surfaced while filling the Contributor Covenant 2.1 enforcement contact in #79; the Code of Conduct address was corrected there, but cabal metadata is release-facing rather than Code of Conduct scope, so it was left out of that change.

collection-json.hs carries the same stale address at `collection-json.cabal:15`, so this is a shared gap rather than a siren-only one.

## Scope

- Set `maintainer:` in `siren-json.cabal` to `alunduil@gmail.com`.

## Acceptance criteria

- [ ] `siren-json.cabal`'s `maintainer:` field is an address that reaches the maintainer.

## Additional context

`COPYRIGHT:1` also carries the old address, deliberately left alone — it records the notice as asserted in 2017 rather than a live contact channel.

The corrected address reaches Hackage on the next upload, which is manual (`cabal sdist` then `cabal upload --publish`), so the fix does not take effect until the `1.0.0.0` release.