chore: fresh entropy on RNGs

[titouantanguy]

Description

Adds a global registry that holds weak references to the rngs derived from the BaseKmsStruct.
Upon new epoch, refresh all those RNGs by making a seed from current RNG and adding entropy from OS and ,if available, the security module.

Related issue(s)

https://github.com/zama-ai/kms-internal/issues/3150

PR Checklist

Tick all that apply — by ticking I attest the item holds; justify any deviation in the description above.

• Title follows conventional commits (e.g. chore: ...).
• Tests added for every new pub item and test coverage has not decreased.
• Public APIs and non-obvious logic documented; unfinished work marked TODO(#issue).
• unwrap/expect/panic only in tests or for invariant bugs (documented if present).
• No dependency version changes OR (if changed) only minimal required fixes.
• No architectural protocol changes OR linked spec PR/issue provided.
• No breaking deployment config / Helm chart / telemetry changes OR devops label + infra notified + review requested.
• No breaking gRPC / serialized data changes OR commit marked with ! and affected teams notified.
• No modifications to existing versionized structs OR backward compatibility tests updated.
• No critical business logic / crypto changes OR ≥2 reviewers assigned.
• No new sensitive data fields OR Zeroize + ZeroizeOnDrop implemented.
• No new public storage data OR data is verifiable (signature / digest).
• No unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.
• Strongly typed boundaries: typed inputs validated at the edge; no untyped values or errors cross modules.
• Self-review completed.

Dependency Update Questionnaire (only if deps changed or added)

1. Ownership changes or suspicious concentration?
2. Low popularity?
3. Unusual version jump?
4. Lacking documentation?
5. Missing CI?
6. No security / disclosure policy?
7. Significant size increase?

More details in CONTRIBUTING.md and AGENTS.md.

[kc1212]

Great work! I left some comments

[titouantanguy]

Somewhat big refactor after the initial review to make the RngRegistry a global static so that it doesn't depend on a partiuclar BaseKmsStruct

[kc1212]

LGTM！