Bump httpfs (duckdb#24003)

Title

Fix more geom stats (duckdb#23295)

Followup to https://github.com/duckdb/duckdb/pull/23241/changes

Remove checked_array_iterator from fmt dep (1.4) (duckdb#23239)

This is a backport of the PR duckdb#22706 (duckdb#23238 in 1.5) to `v1.4-andium`
stable branch.

This PR removes
[stdext::checked_array_iterator](https://learn.microsoft.com/en-us/cpp/standard-library/checked-array-iterator-class?view=msvc-180)
usage applying the changes from [this
commit](fmtlib/fmt@9bea6ec)
to the version of the `fmt` library included in the `third_party` dir.

It is checked on Visual Studio 18.6.0 released on May 12.

Fixes: duckdb#22704

Return an error if a negative number is passed to the factorial funct…

…ion (duckdb#22731)

Fixes: duckdb#22720

Revert "Run ArrowConverter::ToArrowSchema in a transaction" (duckdb#2…

…2007)

Reverts duckdb#21927

Bump vcpkg-duckdb-ports baseline (duckdb#21493)

While building duckdb-iceberg with the avro extension 
`duckdb-iceberg ✗ make clean &&
BUILD_EXTENSIONS='httpfs,avro,parquet,iceberg' make debug`
I ran into vcpckg errors while building avro. This fixes it.

bump spatial (duckdb#21206)

Fail fast extensions (duckdb#20605)

Changes so that INSTALL also performs signature checks (according to
database configuration).
This is somewhat redundant, BUT avoids cases where one might successful
install an extension that can't be then loaded.

Logic is as follows:
1. files ending in ".duckdb_extension" can only be created in the
INSTALL path
2. when moving, either ending ".duckdb_extension" is present both in
source and target, OR it should not be present on target
3. on install, we first verify signature of the buffer, then copy data
to "name.tmp-UUID.duckdb_extension", then move it to
"name.duckdb_extension". Note that this is legal with both 1 & 2, and
makes so that all files (written by duckdb) that ends in
'.duckdb_extension' are signature checked
4. on load, we load only from files eneding in ".duckdb_extension"

Basically there are 3 families of files:
* **A**: those ending in '.duckdb_extension'
* **B**. the other files

**B** can be created and moved into freely
**A** can only be created during install path (since it's the only place
where we pass the flag, and we will only create **B**)
**A** can only be moved into from other **A** files, while **A** can be
moved to a **B**
**A** is the only type of file we would load from

backport runner cleanup action (duckdb#20085)

Fix minor crypto issues (duckdb#19716)