Tracker: rand v0.10

[dhardy]

Summary

• Bump MSRV to 1.85 (also Edition 2024)
• Wait for chacha20 v0.10 release (@tarcieri)
• Replace rand_chacha with chacha20 (draft: Adapt to chacha20 #1642; closes Replacing rand_chacha with chacha20 #934)
• Release rand v0.10 using rand_core v0.9.x

Motivation

#934 and #1574 provide motivation for the switch to chacha20.

The MSRV bump is required by chacha20; releasing this as rand v0.10 not v0.9.x makes the MSRV bump less problematic and the significant change in dependency more transparent.

Not making a breaking release for rand_core makes the transition to rand v0.10 easier for users: RngCore/CrpytoRng/... implementations and bounds will be compatible across rand v0.9 and v0.10.

Alternatives

No CSPRNG (by default)

OsRng (i.e. the OS getrandom / ... interfaces) is fast enough for many use-cases already, so not everyone actually needs a thread-local in-process CSPRNG. #1545 proposes this.

No CSPRNG at all

We could go even further and completely drop ThreadRng, but I don't see much incentive over #1545 (the main one being simplicity).