bump rand and rand_chacha to 0.9.0 (part 1)

[yihau]

Summary of Changes

• pin rand for zk-sdk/zk-token-sdk (wait for curve25519-dalek unblock rand dep)
• pin rand and rand_chacha for core/gossip/perf/turbine (will have another PR for those core logic)
• lots of api changes (https://github.com/rust-random/rand/blob/master/CHANGELOG.md#090---2025-01-27)

[mergify]

The Firedancer team maintains a line-for-line reimplementation of the
native programs, and until native programs are moved to BPF, those
implementations must exactly match their Agave counterparts.
If this PR represents a change to a native program implementation (not
tests), please include a reviewer from the Firedancer team. And please
keep refactors to a minimum.