[Vedin]

Which issue does this PR close?

No standalone issue. Downstream Oracle work is tracked in Rustice #1198; the syntax changes are parser #46 and parser #47.

Rationale for this change

Consumers need a coherent DataFusion/sqlparser pair for typed warehouse statements and TABLE COMMENT = NULL while retaining the opt-in VALUES metadata resolver. The existing security audit also reports 15 inherited vulnerabilities in the workspace lockfile; the update resolves those findings without adding audit exceptions.

What changes are included in this PR?

Pin sqlparser and its derive package to qualified commit 3b740083360c8f757f2d8fb8029ebeef727194f8.

Update the affected locked packages to compatible security fixes: ctutils 0.4.4, quinn-proto 0.11.18, rustls 0.23.46, rustls-webpki 0.103.16, zstd 0.13.4, zstd-safe 7.4.0 and zstd-sys 2.1.2+zstd.1.5.7. Quinn's upstream requirements add rand_pcg 0.10.2 and WASM RNG dependency edges for the existing getrandom 0.4.2. Other locked package records remain unchanged.

Only Cargo.toml and Cargo.lock differ from the base. All 1,701 DataFusion Rust files, including the VALUES hook and strict/equal-metadata fast paths, remain exact.

Are these changes tested?

Fresh qualification on the patched lock uses Rust 1.97.0, one build job and a 5/8/1 GiB memory-high/max/swap cap:

• Formatting, strict all-target/all-feature Clippy (-D warnings) and the unmodified full dev/rust_lint.sh pass.
• The required extended workspace passes 10,767 native tests, zero failures and 10 existing ignored; its separate SQL runner passes all 509 files with one explicit test thread.
• Fresh Cargo artifacts match all 73 executed harnesses and the CI opt-level-0/assertions/overflow profile; each executable was hashed once.
• cargo-audit 0.22.2 reports zero vulnerabilities against advisory database 309392b18f6b17022f82c701f300433126901068. The existing two ignore IDs remain unchanged.

No fixture expectations changed. No result from the earlier parser-only or older dependency graphs is inherited.

Are there any user-facing changes?

The public parser AST adds warehouse statement variants and typed TABLE COMMENT = NULL; exhaustive downstream matches may require updates (api change label applied). Warehouse execution and downstream admission remain separate work. Library consumers must resolve and qualify their own lockfiles; they do not inherit this workspace's Cargo.lock or audit result.