fix(ios): hash complete nonce bytes and batch random generation

[OskarEichler]

Fixes: complete UTF-8 nonce hashing and cheaper random generation

• Hash NSData bytes and length, not strlen(UTF8String), so an embedded NUL does not truncate the nonce.
• Request 16 random bytes per batch into a stack buffer, eliminating 16 individual calls and boxed-byte arrays per batch. Keep the same alphabet and rejection sampling.
• Throw on random-source failure in release builds as well as debug builds; do not let a compiled-out assertion silently continue with invalid random bytes.

Compatibility / observable changes

Nonces containing NUL now hash their complete UTF-8 byte sequence, matching ordinary SHA-256 implementations. ASCII and Unicode nonces without NUL are unchanged. A random-source failure now raises the existing internal-inconsistency exception category in release builds rather than generating invalid output. The alphabet, output length, hashing algorithm and public methods are unchanged.

Reproduction and measurement

Compiled the actual Objective-C utility against Foundation/Security/CommonCrypto, with a deterministic random-source stub. Empty/ASCII/Unicode/NUL hashing has one baseline mismatch and zero fixed mismatches. Nonce lengths 0/1/16/32/128 are preserved. Random-source calls for those lengths change from 0/16/16/32/320 to 0/1/1/2/20. This is a call-count measurement, not an end-to-end authentication benchmark. Injected random failure throws with NS_BLOCK_ASSERTIONS enabled.

Verification

• Upstream ESLint and existing TypeScript usage checks pass.
• Focused inline reproductions compare unchanged 5f7a8d7 with the fix; no test/spec files were changed.
• React Doctor reports 100/100 on the changed JavaScript scope.
• Consumer verification now passes on React Native 0.87.1: both Android Debug flavors, both iOS Simulator Debug schemes (unsigned), all four production-mode Metro bundles, immutable Yarn install and app lint. All seven changed installed source files match the verified fork.
• No real Apple sign-in, account changes, physical-device authentication, macOS/visionOS runtime checks or signed release archives were performed.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}