Fix java/insecure-randomness CodeQL alerts by using SecureRandom (#758)

Valery Kharseko

yesterday 5a2a992ee6143d605f358a9f6379e7916e346def

 opendj-ldap-toolkit/src/main/java/com/forgerock/opendj/ldap/tools/AuthRate.java

@@ -13,6 +13,7 @@
 *
 * Copyright 2010 Sun Microsystems, Inc.
 * Portions Copyright 2011-2016 ForgeRock AS.
 * Portions Copyrighted 2026 3A Systems, LLC.
 */
package com.forgerock.opendj.ldap.tools;

@@ -25,11 +26,11 @@
import static com.forgerock.opendj.cli.CommonArguments.*;

import java.io.PrintStream;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Collections;
import java.util.LinkedList;
import java.util.List;
import java.util.Random;

import com.codahale.metrics.RatioGauge;
import com.forgerock.opendj.cli.MultiColumnPrinter;
@@ -108,10 +109,10 @@
            private Object[] data;
            private final char[] invalidPassword = "invalid-password".toCharArray();

            private final ThreadLocal<Random> rng = new ThreadLocal<Random>() {
            private final ThreadLocal<SecureRandom> rng = new ThreadLocal<SecureRandom>() {
                @Override
                protected Random initialValue() {
                    return new Random();
                protected SecureRandom initialValue() {
                    return new SecureRandom();
                }
            };

@@ -183,7 +184,7 @@
                    useInvalidPassword = true;
                    break;
                default:
                    final Random r = rng.get();
                    final SecureRandom r = rng.get();
                    final int p = r.nextInt(100);
                    useInvalidPassword = p < invalidCredPercent;
                    break;