Use syscall-based entropy reading where possible.
When we're setting up our CSPRNG, we should use syscalls where possible, and ensure that we're using the "block if inadequately seeded" variant whenever one exists.
See #10676 (moved) for an earlier version of this; but that isn't the sensible way to do it at all. I'll start working on this once I have a linux that supports getentropy().