Replace the random library with secrets in oauth1

The module keystone.oauth1.backends.sql was using the random library to
generate the verifier of a request token.  The bandit security scanner
tool from version 1.8.4 onwards identifies the use random.sample as a
low security issue, despite random actually being an alias to
random.SystemRandom(). This change replaces the use of random library
with the secrets library and avoids the use of shadowing random.

Change-Id: I1a0ecd80a44eae6032e985091032aa91ee5c81a5
Signed-off-by: Adrian Jarvis <adrian.jarvis@catalystcloud.nz>

keystone/oauth1/backends/sql.py

@@ -13,7 +13,7 @@
 # under the License.
 
 import datetime
-import random as _random
+import secrets
 import uuid
 
 from oslo_serialization import jsonutils
@@ -25,7 +25,7 @@ from keystone import exception
 from keystone.i18n import _
 from keystone.oauth1.backends import base
 
-random = _random.SystemRandom()
+system_random = secrets.SystemRandom()
 
 
 class Consumer(sql.ModelBase, sql.ModelDictMixinWithExtras):
@@ -206,7 +206,7 @@ class OAuth1(base.Oauth1DriverBase):
             token_dict = token_ref.to_dict()
             token_dict['authorizing_user_id'] = user_id
             token_dict['verifier'] = ''.join(
-                random.sample(base.VERIFIER_CHARS, 8)
+                system_random.sample(base.VERIFIER_CHARS, 8)
             )
             token_dict['role_ids'] = jsonutils.dumps(role_ids)