fix: upgrade rand to address RUSTSEC-2026-0097

## Security Advisory: RUSTSEC-2026-0097

**Package:** `rand`  
**Advisory:** https://rustsec.org/advisories/RUSTSEC-2026-0097

### Affected versions in this repo
- `rand 0.8.5` → needs `>= 0.8.6`

### Fix
```bash
cargo update "rand@0.8.5"
```

> Automatically identified by Otto security scanning.