Deprecate RandomSessionIdGenerator due to insufficient entropy (#2770)

Author: lprimak

core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java

@@ -30,7 +30,10 @@
  * implementation is a {@link java.security.SecureRandom SecureRandom} with the {@code SHA1PRNG} algorithm.
  *
  * @since 1.0
+ * @deprecated since 2.2.1. Use {@link JavaUuidSessionIdGenerator} instead, as this class is no longer considered
+ * secure by modern standards.
  */
+@Deprecated(forRemoval = true, since = "2.2.1")
 public class RandomSessionIdGenerator implements SessionIdGenerator {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(RandomSessionIdGenerator.class);