chore(load-tests): document non-security-sensitive Math.random() usages to resolve SonarCloud hotspots

[Copilot]

SonarCloud flagged five Math.random() calls (rule javascript:S2245) across four load-test scenarios. All usages are non-security-sensitive — they vary sleep/think-time and weight scenario routing, not secrets or tokens.

Changes

• 03-concurrent-uploads.js L143 — sleep jitter
• 06-full-stress.js L90 — weighted scenario routing (40/30/20/10% split)
• 06-full-stress.js L145 — sleep jitter
• 08-screening-session.js L333 — think-time jitter
• 09-soak.js L298 — think-time jitter

Added a two-line comment above each usage, consistent with the pattern already established in 07-admin-journey.js (previously marked SAFE):

// Math.random() is safe here: adds non-cryptographic timing jitter to simulate realistic user think-time.
// Not a security-sensitive use case (no token generation, secret material, or authentication involved).
sleep(2 + Math.random() * 2);

The five SonarCloud hotspots can now be marked SAFE with justification: used only for load-test randomisation; not used for secrets, credentials, tokens, or authorisation decisions.