Use the random generator factory for closed readonly fields

Opt-in modern-.NET port of explicit private readonly RNGCryptoServiceProvider fields used only for known parameterless allocations and BCL byte-array GetBytes/GetNonZeroBytes calls. Preserve allocation sites, shared generator reuse, arguments and lifetime, using a collision-safe RandomNumberGenerator field and Create(). Leave escaping, identity/configuration/cleanup uses, exposed or mutable fields, attributes, partial/generic/proxy/serializable owners, expression-bodied lambdas/queries and snapshots and provider-type imports unchanged. Does not preserve provider identity, random-stream identity, reflection/serialization or Framework platform/FIPS policy. Statement-bodied delegate lambdas retain their original bodies and execution timing. No new cleanup policy; not in version composites.