upgrade nanorand to 0.5.2

[tgolsson]

nanorand generates incorrect random numbers before 0.5.1, see RUSTSEC-2020-0089. It also doesn't support generating signed numbers any more, so this PR adds a workaround for that.

[udoprog]

Thanks!

Might be worth to use rand at least by default. Even if we don't provide much of a stability guarantee at the moment, it's currently a more vetted alternative. And it's already included as a transitive dependency.

[tgolsson]

@udoprog Where did you find rand in the dependency tree?

➜ cargo tree | grep rand
│   │   ├── nanorand v0.5.2
│   │   │   └── getrandom v0.2.0

[udoprog]

@udoprog Where did you find rand in the dependency tree?

➜ cargo tree | grep rand
│   │   ├── nanorand v0.5.2
│   │   │   └── getrandom v0.2.0

Oh. I thought it was part of the reqwest dependency tree. I guess not!