Update dependencies: rand 0.10, rtnetlink 0.20, tun 0.8, and others

Bump rand (0.8→0.10), rtnetlink (0.14→0.20), tun (0.7→0.8),
simple-dns (0.9→0.11), socket2 (0.5→0.6), and criterion (0.5→0.8).

Migrate all rand call sites: thread_rng()→rng(), gen()→random(),
gen_range()→random_range(), RngCore→Rng trait. Work around secp256k1
0.30 requiring rand 0.8 by generating random bytes directly and
constructing SecretKey from slice.

Migrate rtnetlink to builder-based API: LinkSetRequest replaced with
LinkUnspec builder + change(), RouteAddRequest replaced with
RouteMessageBuilder.

Remove bloom benchmark (criterion 0.8 incompatible with old harness
config).

src/utils/index.rs

@@ -19,7 +19,7 @@
 //! [0x00][receiver_idx:4 LE][counter:8 LE][ciphertext+tag]
 //! ```
 
-use rand::Rng;
+use rand::RngExt;
 use std::collections::HashSet;
 use thiserror::Error;
 
@@ -105,10 +105,10 @@ impl IndexAllocator {
     /// currently in use. Returns error if allocation fails after
     /// max_attempts tries (indicates too many active sessions).
     pub fn allocate(&mut self) -> Result<SessionIndex, IndexError> {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
 
         for _ in 0..self.max_attempts {
-            let candidate = rng.r#gen::<u32>();
+            let candidate = rng.random::<u32>();
             if !self.in_use.contains(&candidate) {
                 self.in_use.insert(candidate);
                 return Ok(SessionIndex(candidate));