chore: suppress math/rand Semgrep finding on two non-security use sites

Addresses the Semgrep finding on PR #599
(go.lang.security.audit.crypto.math_random.math-random-used) on the
update-check jitter delay, and applies the same treatment to the #419
activity-log filename suffix, which has the same non-security shape but
predates this PR's diff so it wasn't flagged.

Neither value is ever compared, kept secret, or otherwise security-
sensitive (a sleep duration and a filename-uniqueness suffix), so
crypto/rand would only add error-handling overhead for no real benefit.
Suppressed with the same // nosemgrep: <rule-id> pattern already used in
the mock-amazon/mock-spotify/mock-tunein servers, mirroring the existing
//nolint:gosec on the same lines.

Refs #591

cmd/soundtouch-service/main.go

@@ -1273,6 +1273,7 @@ func randomJitter(upperBound time.Duration) time.Duration {
 		return 0
 	}
 
+	// nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used
 	return time.Duration(rand.Int63n(int64(upperBound))) //nolint:gosec
 }
 

pkg/service/datastore/datastore.go

@@ -2818,7 +2818,10 @@ func (ds *DataStore) RecordActivity(kind, id string, detail map[string]interface
 
 	// The random suffix guards against two events for the same id landing in
 	// the same nanosecond (observed as flaky on coarser-resolution clocks)
-	// silently overwriting one another instead of both being recorded.
+	// silently overwriting one another instead of both being recorded. Not
+	// a security-sensitive use of randomness — only affects filename
+	// uniqueness, not any value that's compared or kept secret.
+	// nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used
 	filename := fmt.Sprintf("%d_%d_%s.json", now.UnixNano(), rand.Int63n(1_000_000), id) //nolint:gosec
 	path := filepath.Join(dir, filename)