An invalid `datafusion.format.*_format` string panics when results are printed

### Describe the bug

The `datafusion.format.{date,datetime,timestamp,timestamp_tz,time}_format` options are passed straight to `arrow::util::display::FormatOptions` (`TryFrom<&FormatOptions>` in `datafusion/common/src/config.rs`). An invalid `strftime` specification is only detected while a value is rendered: the arrow `Display` impl returns `fmt::Error`, and callers that use `format!` / `to_string` (for example `datafusion-cli`'s table printer when the row limit is hit) turn that into a panic.

### To Reproduce

```sql
SET datafusion.format.time_format = '%';
SELECT time '12:00:00';
```

```text
thread 'main' panicked at library/alloc/src/string.rs:2929:14:
a Display implementation returned an error unexpectedly
```

(`datafusion-cli/src/print_format.rs:138` via `format!("{formatted}")`.) The same happens with `datafusion.format.timestamp_format = '%'` and `SELECT to_timestamp(0)`, and with `date_format`.

### Expected behavior

`SET` or, at the latest, the conversion to arrow's `FormatOptions` should reject the string with a configuration error naming the option, the way `datafusion.execution.parquet.writer_version` is validated.

### Additional context

Found while running a corpus of extreme configuration values against a debug build of `datafusion-cli`.

Start in datafusion/common/src/config.rs at the TryFrom<&FormatOptions> conversion, then inspect datafusion-cli/src/print_format.rs:138 and reproduce the SET/SELECT examples. Trace where invalid strftime strings are first validated and verify that the named format options produce a configuration error instead of a rendering panic.

Written by the indexing model from the issue text.