CIVI-SA-2025-08: Harden createRandom()

The helper function CRM_Utils_String::createRandom() relies on a "cryptographically weak" random number generator.

A "weak" generator appears random but can sometimes be predicted. The significance depends on the specific use-cases which call this helper.

• For cryptography, CiviCRM does not use this helper. (It uses the more appropriate random_bytes().)
• A partial survey of createRandom() use-cases has found that callers often have other mitigating circumstances. (No useful exploits are known.)
• Never-the-less, this is a generic helper on an extensible platform. It could be used in insecure and unforeseen ways.

As a precaution, the helper will use a "stronger" random number generator.

(Note: An earlier revision of this advisory was inaccurately published under the heading "CIVI-SA-2026-08". It should be "CIVI-SA-2025-08".)