oids: switch from PRNG to random module

[ringabout]

0x7fff is enough to use and is often used as RAND_MAX in PRNG.
http://www.cplusplus.com/reference/cstdlib/RAND_MAX

• If this PR is acceptable, next PR will add a overload for genOid which accepts Rand as a parameter.

Benefits:

• More pure(more possible to work in JS backend)
• Benefits from the improvement from random module
• Random module also provides better interface(initRand, next) and could be used to improve genOid

[planetis-m]

Could it be easy to convert cstring usage to strings, or at least openarray[char]?

[ringabout]

I don't like oidToString*(oid: Oid, str: cstring) because cstring slice doesn't work in JS backend. I will consider cleaning these procs in next PR(if possible). At least proc $*(oid: Oid): string shouldn't rely on cstring version.

[timotheecour]

use this (I checked, it works):

proc toStringImpl*[T: string | cstring](result: var T, oid: Oid) =
  ## Converts an oid to `str`.
  type T = typeof(result)
  const hex = "0123456789abcdef"
  const N = 24

  when T is string:
    result.setLen N

  var o = oid
  var bytes = cast[cstring](addr(o))
  var i = 0
  while i < 12:
    let b = bytes[i].ord
    result[2 * i] = hex[(b and 0xF0) shr 4]
    result[2 * i + 1] = hex[b and 0xF]
    inc(i)
  when T is cstring:
    result[N] = '\0'

proc oidToString*(oid: Oid, str: cstring) {.deprecated: "unsafe; use `$`".} =
  ## assumes str is space allocated for 25 elements.
  # work around a compiler bug:
  var str = str
  toStringImpl(str, oid)

proc `$`*(oid: Oid): string =
  ## Converts an oid to string.
  toStringImpl(result, oid)

(refs #16201 (comment))
EDIT: => #16704

[timotheecour]

@xflywind this PR introduces a regression:

when true:
  import std/oids
  import std/random
  import std/sugar

  proc main()=
    let s = collect(newSeq):
      for i in 0..<10: rand(int.high)
    echo s
  main()

nim c main

before PR:

• commenting or not import std/oids gives same results
  after PR:
• with import std/oids, running ./main gives same results for runs within 1 second apart (seeding via var t = getTime().toUnix.int32 is bad, 0-arg random.randomize() is better at least, but still this needs more thought)

I recommend splitting this PR in 2:

• 1 for all the cleanups (no change to PRNG) => non controversial, easy to accept, after above proposed changes have been addressed
• 1 for the PRNG => random change, which needs more care and should be done separately

[ringabout]

The regression has been fixed.

[FedericoCeratto]

The random module is not cryptographically secure.
Please put a warning in the documentation to remind users that future OIDs can become predictable to an attacker that can reverse the initial seed value.

[ringabout]

Since original implementation using srand and rand is not secure(?) too, I could add these warnings in the following PR.

http://www.cplusplus.com/reference/cstdlib/srand/

[planetis-m]

Can this be merged as is? It's already an improvement.