fix(sysrand): resume getrandom at correct offset after short reads

[cryo2010]

Summary

Fixes #103.

On Linux, randomBytes fills the caller's buffer by looping over getrandom(2), which may return fewer bytes than requested for large buffers. The loop computed the resume pointer p but passed the buffer start pbytes to the syscall on every iteration:

p = cast[pointer](cast[uint](pbytes) + uint(res))
let bytesRead = syscall(SYS_getrandom, pbytes, nbytes - res, 0)  # should be p

After a partial read, subsequent reads overwrote the beginning of the buffer and left the tail untouched, while res still accumulated to nbytes so the routine reported full success. Callers could receive predictable (uninitialized) bytes in the tail of keys, nonces, or salts.

Changes

• refactor: extract the short-read offset-accumulation loop into a reusable fillRandomBytes helper that takes a reader callback. This is behavior-preserving and creates a testable seam (the raw getrandom loop was previously not unit-testable, since partial reads are nondeterministic).
• test: add a regression test that drives fillRandomBytes with a mock reader emulating short reads (<= 8 bytes/call) and asserts the whole buffer is written.
• fix: pass the resumed offset p to the reader so the buffer is filled from the correct position.

Testing

nim c -r --path:. tests/testsysrand.nim passes all cases, including the new "getrandom partial-read offset test". The test fails on the pre-fix code and passes after the one-line fix.