Use PHP7 random_int
The GoogleAuthenticator class now uses random_int for the pseudo random generation. That function is available in PHP7 and there is a polyfill (linked in the README) for previous versions. If neither is present, it will default to it's current behavior.
Thanks to @inanimatt for the suggestion.