[isc-fschwich]

Fixes the two critical CodeQL alerts that the Dependabot roll-up (#180) raised. Both are "hard-coded cryptographic value", on the AES key and nonce constants in tests/unit/test_vscode_payload.rs.

Why the alerts appeared now

• The constants ([7u8; 32], [3u8; 12]) have been in the test for a long time.
• In chore(deps): Dependabot roll-up #180, aes-gcm 0.11 deprecated from_slice, so the test helper switched to From. CodeQL follows From from the constant into the cipher.
• They're test fixtures and nothing ships with them. The fix is still cheap, and it keeps CodeQL scanning the test code for everything else.

The fix

• Every test seals and opens with the same key, so the actual value never mattered.
• The key and nonce now come from the OS once per run.
• The wrong-key test draws its own key and asserts that it differs.
• getrandom 0.4 is now a dev-dependency of the core crate. It was already in Cargo.lock through uuid, so no crate is added.

Checks

• clippy -D warnings, with and without testing, and fmt are clean.
• The 24 safeStorage payload tests pass.
• cargo deny is clean.
• The agent and git gates pass.

[isc-tdyar]

Approved. Random key and nonce per run; clears the CodeQL fixture alerts.