[branch-52] Update to use lz4_flex 0.12.1 and quinn-proto 0.11.14

[alamb]

Which issue does this PR close?

• part of Release DataFusion 52.4.0 (minor/) Release (Mar 2026) #20855

Rationale for this change

cargo audit is failing on on branch-52 like this:

...
Crate:     lz4_flex
Version:   0.12.0
Warning:   yanked

error: 2 vulnerabilities found!
warning: 4 allowed warnings found

here is an example of that heppening on CI: https://github.com/apache/datafusion/actions/runs/23209529148/job/67454157529?pr=21004

What changes are included in this PR?

• Update lz4_flex 50 0.12.1 (non yanked)

Are these changes tested?

Are there any user-facing changes?

[mbutrovich]

Thanks @alamb. I was just looking at that failure in #21004.

[alamb]

Strangely now there is something related to rust-pem-tls or whatever. Looking

[comphead]

this is the original message

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134

the PR needs to ignore RUSTSEC-2025-0134

[alamb]

this is the original message

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134

the PR needs to ignore RUSTSEC-2025-0134

• in 49dcb05

[comphead]

this backport should fix it #21020

[alamb]

this backport should fix it #21020

Thank you -- I merged that one and then merged this PR up

[alamb]

Thank you for the review / approval @xudong963 and @mbutrovich

[alamb]

whohoo -- it is green!