build(deps): combined dependabot bumps (Cargo + workflows)

[timsaucer]

Which issue does this PR close?

N/A — combined dependabot bumps.

Rationale for this change

Each of the listed dependabot PRs already had CI passing; bundling them into one PR cuts review/merge churn.

What changes are included in this PR?

Cargo updates (Cargo.toml + Cargo.lock):

• tokio 1.50.0 -> 1.52.3 (closes build(deps): bump tokio from 1.50.0 to 1.52.3 #1530)
• arrow-array 58.1.0 -> 58.3.0 (closes build(deps): bump arrow-array from 58.1.0 to 58.2.0 #1522)
• arrow-schema 58.1.0 -> 58.3.0 (closes build(deps): bump arrow-schema from 58.1.0 to 58.2.0 #1523)
• datafusion 53.0.0 -> 53.1.0 (closes build(deps): bump datafusion from 53.0.0 to 53.1.0 #1515)
• datafusion-catalog 53.0.0 -> 53.1.0 (closes build(deps): bump datafusion-catalog from 53.0.0 to 53.1.0 #1513)
• datafusion-ffi 53.0.0 -> 53.1.0 (closes build(deps): bump datafusion-ffi from 53.0.0 to 53.1.0 #1512)
• datafusion-proto 53.0.0 -> 53.1.0 (closes build(deps): bump datafusion-proto from 53.0.0 to 53.1.0 #1511)
• datafusion-common 53.0.0 -> 53.1.0 (closes build(deps): bump datafusion-common from 53.0.0 to 53.1.0 #1510)
• mimalloc 0.1.48 -> 0.1.50 (closes build(deps): bump mimalloc from 0.1.48 to 0.1.50 #1514)
• uuid 1.23.0 -> 1.23.1 (closes build(deps): bump uuid from 1.23.0 to 1.23.1 #1508)
• rustls-webpki 0.103.10 -> 0.103.13 (closes build(deps): bump rustls-webpki from 0.103.10 to 0.103.13 #1506)
• rand 0.9.2 -> 0.9.4 (closes build(deps): bump rand from 0.9.2 to 0.9.4 #1495)

GitHub Actions:

• github/codeql-action 4.32.5 -> 4.35.4 (closes build(deps): bump github/codeql-action from 4.32.5 to 4.35.4 #1531)
• astral-sh/setup-uv 7.3.1 -> 8.1.0 (closes build(deps): bump astral-sh/setup-uv from 7.3.1 to 8.1.0 #1500)

Local cargo check and cargo clippy --all-targets --workspace -- -D warnings both pass.

Are there any user-facing changes?

No. Dependency bumps only.