fix(debugger): use crypto.randomUUID() for WebSocket auth token

Replace Math.random().toString(36) with crypto.randomUUID() for generating
the debugger WebSocket path token. Math.random() is not cryptographically
secure and produces predictable output, making it possible for local
attackers to guess the token and connect to the debugger via Chrome DevTools
Protocol. This is the same class of vulnerability as Node.js CVE-2018-7160.

Co-Authored-By: Claude <noreply@anthropic.com>

src/js/internal/debugger.ts

@@ -591,7 +591,7 @@ function parseUrl(input: string): URL {
 }
 
 function randomId() {
-  return Math.random().toString(36).slice(2);
+  return crypto.randomUUID();
 }
 
 const { enableANSIColors } = Bun;

test/cli/inspect/inspect.test.ts

@@ -9,7 +9,7 @@ import { InspectorSession, JUnitReporter, connect } from "./junit-reporter";
 import { SocketFramer } from "./socket-framer";
 let inspectee: Subprocess;
 const anyPort = expect.stringMatching(/^\d+$/);
-const anyPathname = expect.stringMatching(/^\/[a-z0-9]+$/);
+const anyPathname = expect.stringMatching(/^\/[a-f0-9-]+$/);
 
 /**
  * Get a function that creates a random `.sock` file in the specified temporary directory.