fix: remove vulnerable thrift dependency

[gargiulofrancesco]

Summary

• Upgrade Arrow and Parquet benchmark dependencies to 59.1
• Upgrade tpchgen dependencies to 3.0.0
• Regenerate Cargo.lock
• Remove transitive thrift 0.17.0

Validation

• cargo fmt --all --check
• cargo build --all-features --all-targets
• cargo clippy --all-features --all-targets
• cargo doc
• 131 tests and 1 doctest passed

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[0ax1]

Happy if CI is happy

[codspeed-hq]

Merging this PR will regress 2 benchmarks

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks
❌ 2 regressed benchmarks
✅ 28 untouched benchmarks
⏩ 2 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	WallTime	decompress_all[("p_name", 16)]	907.4 µs	1,022.9 µs	-11.29%
❌	WallTime	decompress_all[("p_name", 12)]	1.1 ms	1.3 ms	-10.99%
⚡	WallTime	decompress_all[16]	764.9 µs	659.5 µs	+15.98%
⚡	WallTime	decompress_all[12]	750.5 µs	663.2 µs	+13.15%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing fix/update-parquet-dependencies (0f7824c) with develop (18e5f61)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩