Remove nibbler

This replaces a crazy little thing for generating the box names with a more
obvious "generate a random string".

Improvements

* We reuse `randtoken` which is now used elsewhere
* It's not crazy hard to reason about if you accept randtoken for what it is
* It uses the complete statespace of 36**7
* It doesn't pull in nibbler which requires npm install do git activity every time