Update dependencies: rand 0.10, rtnetlink 0.20, tun 0.8, and others

Bump rand (0.8→0.10), rtnetlink (0.14→0.20), tun (0.7→0.8),
simple-dns (0.9→0.11), socket2 (0.5→0.6), and criterion (0.5→0.8).

Migrate all rand call sites: thread_rng()→rng(), gen()→random(),
gen_range()→random_range(), RngCore→Rng trait. Work around secp256k1
0.30 requiring rand 0.8 by generating random bytes directly and
constructing SecretKey from slice.

Migrate rtnetlink to builder-based API: LinkSetRequest replaced with
LinkUnspec builder + change(), RouteAddRequest replaced with
RouteMessageBuilder.

Remove bloom benchmark (criterion 0.8 incompatible with old harness
config).

src/node/mod.rs

@@ -33,7 +33,7 @@ use crate::upper::icmp_rate_limit::IcmpRateLimiter;
 use crate::upper::tun::{TunError, TunOutboundRx, TunState, TunTx};
 use self::wire::{build_encrypted, build_established_header, prepend_inner_header, FLAG_SP};
 use crate::{Config, ConfigError, Identity, IdentityError, NodeAddr, PeerIdentity};
-use rand::RngCore;
+use rand::Rng;
 use std::collections::{HashMap, VecDeque};
 use std::fmt;
 use std::thread::JoinHandle;
@@ -355,7 +355,7 @@ impl Node {
         let is_leaf_only = config.is_leaf_only();
 
         let mut startup_epoch = [0u8; 8];
-        rand::thread_rng().fill_bytes(&mut startup_epoch);
+        rand::rng().fill_bytes(&mut startup_epoch);
 
         let mut bloom_state = if is_leaf_only {
             BloomState::leaf_only(node_addr)
@@ -452,7 +452,7 @@ impl Node {
         let node_addr = *identity.node_addr();
 
         let mut startup_epoch = [0u8; 8];
-        rand::thread_rng().fill_bytes(&mut startup_epoch);
+        rand::rng().fill_bytes(&mut startup_epoch);
 
         let tun_state = if config.tun.enabled {
             TunState::Configured