Strengthen MySQL superset password generation

Replace random.choice with secrets.choice for CSPRNG, expand charset
from lowercase-only to ascii_letters+digits+punctuation, and increase
length from 12 to 24 characters. The previous password had ~56 bits of
entropy; the new one has ~157 bits.

Closes #89

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
+* Strengthen MySQL superset password: secrets module, expanded charset, 24 chars. (#89)
 
 ### Changed
 

src/crypto.py

@@ -48,7 +48,7 @@
 import base64
 import datetime
 import os
-import random
+import secrets
 import string
 
 import cryptography
@@ -65,7 +65,8 @@ def generate_mysql_root_password() -> str:
 
     @staticmethod
     def generate_mysql_superset_password() -> str:
-        return "".join(random.choice(string.ascii_lowercase) for _ in range(12))
+        charset = string.ascii_letters + string.digits + string.punctuation
+        return "".join(secrets.choice(charset) for _ in range(24))
 
     @staticmethod
     def generate_superset_secret_key() -> str: