Potential fix for code scanning alert no. 4: Insecure randomness

[yynss21]

Potential fix for https://github.com/byRespect/tracker-hub/security/code-scanning/4

To fix the problem, the insecure call to Math.random() must be replaced with a cryptographically secure random number source. For browser-based code, window.crypto.getRandomValues (or crypto.getRandomValues) should be used. We'll generate a random string of sufficient length and in base-36 format to replace the current usage of Math.random().toString(36).substring(2, 11). We need to define a helper function, e.g., generateSecureId, which uses crypto.getRandomValues to produce a random string in the correct format. This helper should be added above createSession. We'll also consider whether to fix the user id generation. If user.id is security-sensitive, a similar change applies.

We'll:

• Add a function (e.g., generateSecureId(length)) to generate a random string using crypto.getRandomValues.
• Use this function to generate both the session id and user id (the latter, if warranted).
• Make sure the import of window.crypto is not needed (accessible globally in browsers), so no import is required.
• Change only the shown snippet, avoiding edits outside.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.