Documented: math/rand → crypto/rand mask key fix (CWE-338, never CVE'd)

**Not a zero-day — already fixed in v1.5.3.** Documenting a silent security fix from commit d67f4185.\n\n- **Finding:** WebSocket mask keys generated with math/rand instead of crypto/rand (CWE-338)\n- **Fix:** v1.5.3 (2024-06-14)\n- **Advisory:** https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597\n- **Tool:** bounty-hunter v6.0