also update bootstraps for new hackage-security, and move splitmix
constraint to where it will work for more than just validate

also updated bootstrap to use ghc 9.10.2, which was missed earlier?