[tobyhede]

Dependency patch for rand (GHSA-cq8v-f236-94qc).

Two semver-incompatible lines of rand were present in the lockfile and both were affected, so both were bumped:

• rand 0.8.5 -> 0.8.6
• rand 0.9.2 -> 0.9.3

A third line, rand 0.10.2, was already past the 0.10.1 fix and is unchanged.

This is an automated security patch update.

[freshtonic]

Approved. The lockfile update exactly applies the patched rand releases required by GHSA-cq8v-f236-94qc: 0.8.5 to 0.8.6 and 0.9.2 to 0.9.3, while leaving the unaffected 0.10.2 line unchanged. The diff contains no unrelated dependency movement, an independent precise lockfile regeneration matched it byte-for-byte, and test, format, and clippy CI checks are green.