proto/discovery: home the recent-request cap and inject request_id from the shell

Two behavior-neutral discovery cleanups:

- Move MAX_RECENT_DISCOVERY_REQUESTS out of the node discovery handler into the
  discovery subsystem limits module and re-export it, keeping the two use sites
  unchanged. Same value and semantics; only its home moves.

- Remove the ambient rand draw from LookupRequest by deleting generate() and
  having the shell draw the random request_id and pass it into the existing
  new() constructor. Same per-request u64 draw, now at the shell, leaving the
  discovery codec free of ambient RNG reads.

src/node/tests/discovery.rs

@@ -1022,11 +1022,11 @@ async fn test_open_discovery_sweep_queues_eligible_skips_filtered() {
 ///      (t=1100ms, 3100ms, 7100ms) and unreachable at t=15100ms.
 ///   2. **Fresh `initiate_lookup` per attempt** — `req_initiated` counter
 ///      increments by exactly one on each retry. The actual `request_id`
-///      is generated by `LookupRequest::generate(...)` via `rand::random()`
-///      inside `initiate_lookup` and is not stored on the originator
-///      side, so per-attempt freshness is verified indirectly: each
-///      `req_initiated` increment corresponds to one fresh
-///      `LookupRequest::generate` call.
+///      is drawn via `rand::rng().random()` at the shell inside
+///      `initiate_lookup` and passed to `LookupRequest::new(...)`; it is
+///      not stored on the originator side, so per-attempt freshness is
+///      verified indirectly: each `req_initiated` increment corresponds
+///      to one fresh `initiate_lookup` call.
 ///   3. **Final-timeout state transitions** — `pending_lookups` entry is
 ///      removed, `discovery.resp_timed_out` counter ticks, queued packet
 ///      is drained, and an ICMPv6 Destination Unreachable frame is