fix: bump rand 0.9.x to patched version
* rand 0.9.2 -> 0.9.3, fixes unsoundness where ThreadRng could hand
out aliased mutable references when a custom logger accessing
rand::rng() triggers a reseed during trace/warn-level logging
(GHSA-cq8v-f236-94qc, low). Reached through hickory-resolver and
opentelemetry_sdk, both linked into the runtime binary.
Two other open advisories are not fixed here because the minimal,
lockfile-only update they need is blocked by version requirements in
Cargo.toml, and this change intentionally sticks to Cargo.lock:
* rand 0.8.5 is pinned exactly (rand = "=0.8.5") in the workspace
Cargo.toml and used directly by the cli crate, so
cargo update --precise 0.8.6 is rejected outright
(GHSA-cq8v-f236-94qc, low).
* hickory-proto/hickory-resolver are pinned to 0.25.2; the fix is
0.26.1, which Cargo treats as a breaking bump for a 0.x crate and
refuses under the current requirement (GHSA-q2qq-hmj6-3wpp,
medium).
Both would require relaxing the version requirement in Cargo.toml,
which is out of scope here.
