[release/2.7]fix go check issues

[wy65701436]

G404: Replace math rand with crypto rand

Signed-off-by: Wang Yan wangyan@vmware.com

[thaJeztah]

should we enable gosec in the golangci-lint config? https://github.com/distribution/distribution/blob/main/.golangci.yml#L2

[codecov-commenter]

Codecov Report

Merging #3531 (9a3ff11) into release/2.7 (691e62e) will decrease coverage by 0.02%.
The diff coverage is n/a.

@@               Coverage Diff               @@
##           release/2.7    #3531      +/-   ##
===============================================
- Coverage        58.77%   58.74%   -0.03%     
===============================================
  Files              102      102              
  Lines             7085     7088       +3     
===============================================
  Hits              4164     4164              
- Misses            2280     2282       +2     
- Partials           641      642       +1     

Impacted Files	Coverage Δ
...b.com/docker/distribution/registry/handlers/app.go	45.99% <0.00%> (-0.26%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 691e62e...9a3ff11. Read the comment docs.

[milosgajdos]

should we enable gosec in the golangci-lint config? https://github.com/distribution/distribution/blob/main/.golangci.yml#L2

I think that's a good idea, but hmm, I wonder what can of worms will that open 😅

[milosgajdos]

As a follow up to this, it seems to be be more of a recommendation, but having checked some perf benchmarks comparisons between the two methods, I think we should merge this in without much worry.

[thaJeztah]

LGTM