Deprecate RandomSessionIdGenerator due to insufficient entropy (64-bit)

Marks the class @deprecated with a Javadoc pointing to JavaUuidSessionIdGenerator.

Modern industry standards (OWASP ASVS, NIST SP 800-63B) require a minimum
of 128 bits of entropy for session tokens. RandomSessionIdGenerator only
provides 64 bits via Long.toString(SecureRandom.nextLong()).

Fixes #2758

Author: wali-reheman

core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java

@@ -30,7 +30,11 @@
  * implementation is a {@link java.security.SecureRandom SecureRandom} with the {@code SHA1PRNG} algorithm.
  *
  * @since 1.0
+ * @deprecated since 2.0. Use {@link JavaUuidSessionIdGenerator} instead. This class uses only 64 bits of entropy
+ *             which is below modern industry minimums (128 bits per OWASP ASVS and NIST SP 800-63B) and poses
+ *             a security risk if used in production.
  */
+@Deprecated
 public class RandomSessionIdGenerator implements SessionIdGenerator {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(RandomSessionIdGenerator.class);