Update rand to 0.9, which changes what a seed means

[zhiaos]

Supersedes #29, which bumps the dependency but not the code that breaks with it.

rand 0.9 renamed SeedableRng::from_entropy to from_os_rng, and make_permutations
calls it on the unseeded branch — so #29 as it stands does not compile. This does the bump
and the rename together.

Why now rather than later

0.9 changes what a seed means. Its changelog lists both of the things this crate uses
under Reproducibility-breaking changes:

• Change fn SmallRng::seed_from_u64 implementation (#1203)
• New, faster algorithms for SliceRandom::shuffle and partial_shuffle (#1272)

Measured rather than assumed — make_permutations(3, 20, Some(42)):

	first permutation
rand 0.8.5	[16, 2, 5, 14, 1, 12, 11, 19, 17, 15]
rand 0.9.5	[16, 17, 19, 6, 9, 5, 18, 8, 10, 11]

So a given seed produces different permutations, and therefore different p-values, either
side of this change.

That is normally a good reason to defer. Here it is the reason to hurry: seeding landed days
ago (#31) and is not yet in a released WebGestaltR, so no seed has been published by
anyone yet. Nothing outside this repository depends on the current stream. Take the break
now and it costs a golden file; take it in six months and it invalidates every seed a user
has quoted in a methods section in between.

Not included: rand 0.10

0.10 requires Edition 2024 and MSRV 1.85, which would raise the floor for every downstream R
and Python user, and it removes from_os_rng again. That deserves its own decision. 0.9's
MSRV is 1.63.0, exactly what both manifests already declare, so this change needs no
toolchain bump.

Verified

cargo test --all passes — 5 tests across 5 suites, including the make_permutations
doctest. No other rand API is used: the whole surface is SliceRandom, SeedableRng,
seed_from_u64, from_os_rng and shuffle, all in gsea.rs.

Downstream, after merge

• WebGestaltR needs cargo update -p webgestalt_lib and a regenerated vendor.tar.xz
• the rebuild's seeded parity golden must be recaptured — it will fail loudly first, which
  is the check doing its job
• worth a NEWS.md line: seeds are comparable within a version, not across versions