[GHSA-597g-3phw-6986] virtualenv: align described fixed version with the recorded range (fixed in 20.36.1, not 20.36.2)

[pacocartones]

Summary

The prose in this advisory tells users to upgrade to virtualenv 20.36.2, but that version does not exist. The TOCTOU fix actually shipped in 20.36.1.

Evidence

• PyPI: virtualenv 20.36.1 exists (200); 20.36.2 returns 404 — it was never released. Latest is 21.7.4.
• Upstream changelog (docs/changelog.rst): under Bugfixes - 20.36.1: "Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks … (issue [GHSA-vmq6-5m68-f53m] logback serialization vulnerability #3013)".
• The structured field affected.ranges.events.fixed = "20.36.1" is already correct; this PR only aligns the human-readable details.

Changes (details prose only)

• "Versions with the fix: 20.36.2 and later" → "20.36.1 and later"
• "Users should upgrade to version 20.36.2 or later" → "20.36.1"
• "Affected versions: All versions up to and including 20.36.1" → "up to but not including 20.36.1" (20.36.1 is the fixed version, so it shouldn't be listed as affected; this now matches the structured range)

No structured data changed.