Make the displaymarker _slightly_ more random.

Without this, an attacker might infer the password length based on a
screenshot and the time of day, as rand() is a deterministic PRNG without
any runtime entropy sources.

After this change, the attacker will additionally need the exact
microsecond-accurate time of day, and the process ID.

We may alternatively move to using /dev/urandom or getrandom here, but this
does not seem worth the effort, given an attacker can learn the same info by
pointing a video camera at screen or keyboard, or a microphone at the keyboard.