[SECURITY] 0-pad to length in random string generation