Potential fix for code scanning alert no. 2: Insecure randomness

[yynss21]

Potential fix for https://github.com/byRespect/tracker-hub/security/code-scanning/2

To fix the problem, we need to ensure that the randomness used in session ID generation is cryptographically secure. In Node.js, this is accomplished with the crypto module, specifically crypto.randomBytes or crypto.randomUUID (Node.js v14.17+ for randomUUID). In browsers, window.crypto.getRandomValues should be used.

Because the code does not reveal the runtime environment explicitly (Node.js vs browser), but typically session tracking like this is used both client and server side, it's safest to support both environments. The most robust fix is to update createId to use crypto.randomUUID() where possible (Node.js 14.17+/browsers that support it), falling back to crypto.getRandomValues or crypto.randomBytes for randomness and construct an ID similar to original, or use a UUID polyfill otherwise. The fix should be in packages/core/src/shared/utils.ts for the createId function. Also, you'll need to import crypto for Node.js.

No other files need to be edited since all uses of createId will transparently become cryptographically strong.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.