[jrmajor]

OKAPI generated credentials and identifiers with non-cryptographic PRNGs:

• Okapi::generate_key() used rand(). It produces consumer keys and secrets, request and access tokens, and OAuth verifiers.
• Okapi::create_uuid() fell back to mt_rand() when /proc/sys/kernel/random/uuid was unavailable (a comment notes a real duplicate in production).
• OAuthRequest::generate_nonce() used md5(microtime() . mt_rand()).

They now use random_int() / random_bytes():

• generate_key(): random_int(); same alphabet and lengths.
• create_uuid(): RFC 4122 v4 UUID built from random_bytes(16) on all
  platforms; the /proc special case is gone. The format is unchanged
  (lowercase, dashed).
• generate_nonce(): bin2hex(random_bytes(16)); still 32 hex chars.

Output formats are unchanged.

Testing

End to end on local OCPL and OCDE installs: consumer signup, request token, access token and signed calls. Nonce replay is still rejected over HTTP. On OCPL, logs/submit and logs/images/add return valid v4 UUIDs that round-trip through logs/entry.

[hxdimpf]

Looks good to me. All three changes are correct, and the output formats stay the same.

• create_uuid(): & binds tighter than |, so the version and variant bits are set right. str_split(…, 4) with the 8-4-4-4-12 format gives a valid lowercase v4 UUID.
• generate_key(): same alphabet and lengths, only rand() → random_int().
• generate_nonce(): still 32 hex characters. The server side hashes nonces anyway (OkapiDataStore::lookup_nonce), so nothing depends on the old format.

Tested:

• PHP 7.4 and 8.4: 200,000 UUIDs each, all unique and matching the v4 pattern (version 4, variant 8/9/a/b). Keys alphanumeric with the right length, the digits-only verifier 8 digits, nonce 32 hex. No notices or deprecations with error_reporting=-1.
• On the VM (this commit on the current master), OCDE and OCPL on MariaDB 10.11 and 10.0, with the suite from #653, read-only and --write: 0 failures. HMAC requests and the wrong-secret rejection work. On both OCPL installations logs/submit returned v4 UUIDs (e.g. 279f12cc-e73b-4b54-9930-0ae8790fdbc1), and the logs could be edited and deleted.

One note on the merge order: random_int() / random_bytes() need PHP 7.0, while master's composer.json still says >=5.6.0. So this should go in together with or after #651. All nodes we know of run 7.4 or newer, so in practice nothing breaks.