Polyfill crypto.randomUUID() for ZIM content served over plain HTTP on a non-localhost host #391

Context

Follow-up to #387/#389 (openzim/warc2zim#327). After fixing those two, a user testing via a Tailscale MagicDNS hostname over plain HTTP still saw a page's JS completely fail to run, with:

Uncaught TypeError: crypto.randomUUID is not a function

Root cause

crypto.randomUUID() is restricted by browsers to secure contexts (HTTPS, or localhost). A ZIM served over plain HTTP from a non-localhost host — which is an extremely common Kiwix deployment (LAN server, offline hotspot, a Tailscale/VPN hostname, ...) — is not a secure context, so the browser doesn't expose randomUUID at all, and any page depending on it throws instead of running.

This isn't something our rewriting corrupted; it's inherent browser policy triggered purely by how the content happens to be served. But since it will silently break any archived page that uses crypto.randomUUID() (a pretty common API these days — the MDN "Try it" live-sample widgets use it to build a session id) whenever the ZIM isn't accessed via localhost or HTTPS, it's worth providing a polyfill as part of our standard page setup rather than leaving every such site broken on the very common plain-HTTP-non-localhost deployment.

Suggested fix

crypto.getRandomValues() has no such restriction (it's available in all contexts). Polyfill crypto.randomUUID on top of it (standard RFC 4122 v4 UUID construction) whenever it's missing, injected early via wombatSetup.js (which already loads before any page script, via head_insert.html in warc2zim) so it's available to the whole page by the time page scripts run.

I'll attempt a local patch and open a PR against this issue.