Use a cryptographic RNG for auto-generated passphrases

[pscheid92]

age -p with an empty passphrase auto-generates the passphrase that becomes the file's sole secret — but it was drawn from System.Random, a non-cryptographic PRNG whose output is predictable from a little observed data. Switch to RandomNumberGenerator.GetInt32.

Same passphrase format (10 groups of 6 lowercase letters), so this only changes the entropy source; nothing about the file format or CLI surface changes, and only passphrases generated after this commit are affected.

Ported from the security-hardening branch (PR #1, commit cacd850). Full suite green (363 unit + 143 CCTV).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.03%. Comparing base (d618cdf) to head (707bdb6).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #17      +/-   ##
==========================================
+ Coverage   91.99%   92.03%   +0.04%     
==========================================
  Files          41       41              
  Lines        2385     2385              
  Branches      312      312              
==========================================
+ Hits         2194     2195       +1     
+ Misses        133      132       -1     
  Partials       58       58              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.