Update lockfile + fixes for latest package versions

[ADBond]

Upgrade packages in lockfiles, and add relevant fixes.

Splink changes:

• Change default duckdb timestamp format to be UTC rather than arbitrary time-zone, as the latter only worked accidentally (duckdb doesn't accept 'Z' as a timezone specifier for UTC, so existing timestamp formats we used in tests did not work). This shouldn't affect functionality in cases with timestamps coded in ISO-8601 UTC standard, but will mean that anyone using other timezones may need to specify explicit timestamp formats rather than relying on defaults.
• More direct inheritance in custom Spark sqlglot dialect, preventing size function being incorrectly transpiled in more recent package versions

Test-only changes:

• In SQL transformation tests use substring instead of substr, as sqlglot seems to now standardise to the former
• when we mock DatabaseAPI._sql_to_splink_dataframe(...), explicitly register the dummy frame in the connexion. Previously duckdb could still access as it was defined in the same module, but something has changed in how duckdb looks up python objects, so we need to explicitly register it on every call to ensure we can look up the frame in the backend. We need to do it every call, as actions in the test can drop the physical table (as the nature of the mock means that Splink thinks it created this table, even if it is pre-registered)

Closes #2491.
Closes #2511.

For extra constraints in dev dependencies see #2518.