Math.random() is not cryptographically secure

For something where you don't want a possible attacker to have any knowledge of the upcoming lane, the randomizer needs to be cryptographically secure.

Thankfully, this is easy to fix by just using https://developer.mozilla.org/en-US/docs/Web/API/RandomSource/getRandomValues instead of Math.random().

Start by locating the randomizer code that calls Math.random() and read how the upcoming lane is selected. Use the browser RandomSource/getRandomValues API described in the issue, then verify that lane generation no longer relies on Math.random().

Written by the indexing model from the issue text.