Cryptographically secure random bytes from the operating system.

Key material must come from here and never from std/random, whose generator is fast, seedable and therefore predictable.

Linux falls back to /dev/urandom on a kernel older than 3.17 (or a seccomp filter that rejects getrandom with ENOSYS). The libc-free backend issues the getrandom syscall itself. Android bypasses Bionic's API-28 getrandom wrapper and calls the syscall through syscall().