Add security-insecure-random rule for PHP/WHMCS modules

[mladenovic-13]

Detect cryptographically weak PRNG (rand, mt_rand, uniqid, microtime,
time) used for security-sensitive values like tokens, keys, secrets,
nonces, and CSRF tokens. Skips lines with safe alternatives
(random_bytes, random_int, openssl_random_pseudo_bytes).

Summary

• Add security-insecure-random rule detecting CWE-338 vulnerabilities in PHP/WHMCS modules
• Two complementary regex patterns: security-named variable assignment and hash-wrapping weak random
• 12 new tests (7 positive + 5 negative)
• Vulnerable example module (insecure_random.php) for CLI demo
• Updated RULES.md (32 → 33 rules) and vulnerable examples README

Type of Change

• New rule
• Documentation update

Checklist

• npm run validate passes (lint + typecheck + tests + build)
• New rules have positive and negative test cases
• Documentation updated if needed
• No any types introduced

[Stdubic]

Nice