A v4 UUID string.
Prefers crypto.randomUUID, then fills the 16 bytes via crypto.getRandomValues
with the RFC 4122 version/variant bits applied. The user token store mints
anonymous identity tokens with this function; those tokens authorize votes,
comments, and subscriptions, so Math.random must never back them. A runtime
exposing neither secure API throws instead of silently degrading.
Generates an RFC 4122 v4 compliant UUID from a cryptographically secure source.