Cargo audit found RUSTSEC-2026-0194 and RUSTSEC-2026-0195

Cargo audit found the following issues:
```
Crate: quick-xml
Version: 0.39.4
Title: Quadratic run time when checking a start tag for duplicate attribute names
Date: 2026-06-29
ID: RUSTSEC-2026-0194
URL: https://rustsec.org/advisories/RUSTSEC-2026-0194
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0

Crate: quick-xml
Version: 0.39.4
Title: Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
Date: 2026-06-29
ID: RUSTSEC-2026-0195
URL: https://rustsec.org/advisories/RUSTSEC-2026-0195
Severity: 7.5 (high)
Solution: Upgrade to >=0.41.0
```

quick-xml is used by object_store. A fix is available, but we need DataFusion to update to object_store v 0.14 before the later quick-xml can be used.

Start with the Cargo dependency configuration and trace quick-xml through object_store and DataFusion. Confirm the versions currently resolved, then update DataFusion to use object_store 0.14 so quick-xml can reach at least 0.41.0. Run cargo audit and the relevant Rust checks to confirm both RUSTSEC advisories are resolved.

Written by the indexing model from the issue text.