Checkstyle Security - SecureRandom, non-static nested classes & final clone()

So this pull addresses checkstyle security issues (actually, there is no inherent checks in CS for these so I came up with custom rules). All 3 of the following categories pertain to "security". Nothing serious, more like hardening the code:

1. making sure all nested classes are marked as static [about 9-10 instances, mostly in tests]
2. clone() methods marked as final [one instance]
3. Use SecureRandom instead of Random() [one instance]

Review should be pretty easy on the eye as the changes are fairly minimal. In some areas (tests specifically) I had to dance around the code a bit to make sure the now-made-static inner classes still would function without the access to the parent's fields. 
is it really a security issue that a test is doing this?