feat(encryption): support AES-256 keys for reading Parquet data files (#2878)

## Which issue does this PR close?

- Closes #.

Depends on the arrow-rs 58.4.0 release tracked in apache/arrow-rs#10349.

## What changes are included in this PR?

- Bump `arrow`/`parquet` deps from `58` to `58.4`. arrow-rs 58.4.0 adds
AES-256 for Parquet modular encryption (58.3.0 was AES-128 only), landed
via apache/arrow-rs#9203.
- Add an AES-256 encrypted-Parquet read test. Refactored the existing
128-bit test into a shared `assert_encrypted_parquet_roundtrip(key)`
helper with `_aes_128` and `_aes_256` callers.

Note: 192-bit is not supported for data files. arrow-rs uses `ring`,
which has no AES-192-GCM. Can revisit later.

## Are these changes tested?

Yes. Unit test `test_read_encrypted_parquet_aes_256` writes and reads
back a 256-bit encrypted Parquet file. It fails on arrow-rs 58.3.0
(`ring` rejects the 32-byte key) and passes on 58.4.0.

Author: mbutrovich

Cargo.lock

@@ -49,15 +49,15 @@ aes-gcm = "0.10"
 anyhow = "1.0.72"
 apache-avro = { version = "0.21", features = ["snappy", "zstandard"] }
 array-init = "2"
-arrow = "58"
-arrow-arith = "58"
-arrow-array = "58"
-arrow-buffer = "58"
-arrow-cast = "58"
-arrow-ord = "58"
-arrow-schema = "58"
-arrow-select = "58"
-arrow-string = "58"
+arrow = "58.4"
+arrow-arith = "58.4"
+arrow-array = "58.4"
+arrow-buffer = "58.4"
+arrow-cast = "58.4"
+arrow-ord = "58.4"
+arrow-schema = "58.4"
+arrow-select = "58.4"
+arrow-string = "58.4"
 as-any = "0.3.2"
 async-trait = "0.1.89"
 aws-config = "1.8.7"
@@ -121,7 +121,7 @@ murmur3 = "0.5.2"
 once_cell = "1.20"
 opendal = "0.57"
 ordered-float = "4"
-parquet = "58"
+parquet = "58.4"
 pilota = "0.11.10"
 pretty_assertions = "1.4"
 pyo3 = "0.28"

Cargo.toml

@@ -737,9 +737,10 @@ mod tests {
         }
     }
 
-    #[tokio::test]
-    async fn test_read_encrypted_parquet() {
-        let encryption_key = b"0123456789abcdef";
+    /// Writes a single-column Parquet file encrypted with `encryption_key`, then reads it
+    /// back through `ArrowReader` and asserts the round-tripped values. The key length
+    /// selects the AES-GCM variant in arrow-rs (16 -> AES-128, 32 -> AES-256).
+    async fn assert_encrypted_parquet_roundtrip(encryption_key: &[u8]) {
         let aad_prefix = b"aad_prefix";
 
         let schema = Arc::new(
@@ -807,6 +808,16 @@ mod tests {
         assert_eq!(ids.values(), &[10, 20, 30]);
     }
 
+    #[tokio::test]
+    async fn test_read_encrypted_parquet_aes_128() {
+        assert_encrypted_parquet_roundtrip(b"0123456789abcdef").await;
+    }
+
+    #[tokio::test]
+    async fn test_read_encrypted_parquet_aes_256() {
+        assert_encrypted_parquet_roundtrip(b"0123456789abcdef0123456789abcdef").await;
+    }
+
     #[tokio::test]
     async fn test_read_encrypted_parquet_without_key_metadata_fails() {
         let encryption_key = b"0123456789abcdef";