Fail fast extensions (#20605)

Changes so that INSTALL also performs signature checks (according to
database configuration).
This is somewhat redundant, BUT avoids cases where one might successful
install an extension that can't be then loaded.

Logic is as follows:
1. files ending in ".duckdb_extension" can only be created in the
INSTALL path
2. when moving, either ending ".duckdb_extension" is present both in
source and target, OR it should not be present on target
3. on install, we first verify signature of the buffer, then copy data
to "name.tmp-UUID.duckdb_extension", then move it to
"name.duckdb_extension". Note that this is legal with both 1 & 2, and
makes so that all files (written by duckdb) that ends in
'.duckdb_extension' are signature checked
4. on load, we load only from files eneding in ".duckdb_extension"

Basically there are 3 families of files:
* **A**: those ending in '.duckdb_extension'
* **B**. the other files

**B** can be created and moved into freely
**A** can only be created during install path (since it's the only place
where we pass the flag, and we will only create **B**)
**A** can only be moved into from other **A** files, while **A** can be
moved to a **B**
**A** is the only type of file we would load from

backport runner cleanup action (#20085)

Fix minor crypto issues (#19716)

Bump: avro, httpfs (#19248)

This PR bumps the following extensions:
- `avro` from `0c97a61781` to `7b75062f63`
- `httpfs` from `0518838dae` to `8356a90174 (patches removed: 1)`

Bump iceberg (#19001)

Includes duckdb/duckdb-iceberg#465 and
duckdb/duckdb-iceberg#466

bump ducklake for v1.3.2. (#18156)

[tpcds] dsdgen currently assumes DuckTable, throw if that's not the c…

…ase (#17934)

Very minor, but could as well just be fixed.

Currently already handled for TPCH, now also TPCDS.

Fix setup.py to correctly handle OVERRIDE_GIT_DESCRIBE (#17580)

With @Maxxen and @Tishj

This is currently tested at
https://github.com/carlopi/duckdb/actions/runs/15160608765/job/42625694082

Backport @szarnyasg's PR 16999 (#17013)

Thanks @szarnyasg!

bump spatial again (#16518)