fix: use Rng::fill instead of Rng::random for rand 0.9/0.10 compat

Rng::random() was removed in newer rand versions. Rng::fill() is
stable across both 0.9 and 0.10.

Author: zircote

crates/mcp/oauth/token.rs

@@ -57,8 +57,8 @@ pub struct TokenResponse {
 
 /// Generate an opaque refresh token.
 fn generate_refresh_token() -> String {
-    use rand::Rng as _;
-    let bytes: [u8; 32] = rand::rng().random();
+    let mut bytes = [0u8; 32];
+    rand::fill(&mut bytes);
     base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
 }