chore: bump erpl-bics and erpl-odp for the tuning API and test hardening

[jrosskopf]

Pointer bump only — the submodules have no CI of their own, so this is where their
changes get built across the matrix.

erpl-odp (DataZooDE/erpl-odp#8)

• Crash fix: OdpSessionLocalState returns nullptr when the queue drained before
  a worker started — which DuckDB does whenever it opens more local states than there
  are packages — and OdpSessionScan cast it unconditionally. Reproducible with
  threads := 8.
• First settings for erpl_odp, which had none: erpl_odp_fetch_size and
  erpl_odp_max_threads, matching erpl_rfc's vocabulary. I_MAXPACKAGESIZE was
  compiled in at 2 MiB and unreachable.
• 17 assertions that could not fail, replaced. Three delta tests passed end-to-end
  if read_delta always returned nothing.

Measured while doing it: at the default 2 MiB the ODP test source yields 3 packages,
so the threads sweep was mostly exercising the drained-queue path, not concurrent
hand-off. At 16 KiB it yields 195, and 20 runs at threads=16 came back identical.

erpl-bics (DataZooDE/erpl-bics#11)

• sap_bics_begin's rows / columns / filters were declared and never read. They
  now place characteristics at open time, which also removes three full session
  round-trips from building a query.
• Models the fixed cost of a fetch — previously assumed to be zero — and exposes both
  cost terms as settings. Budget defaults deliberately unchanged; correcting them
  would cut permitted sizes ~10x, which is a product decision, not a refactor.
• The overflow message now states what a refused query will really cost. Memory scales
  with result rows, not data cells, so the cell-derived figure understated a
  46,755-row result by 19x (34 MB quoted, 666 MB actual). The new estimate predicts
  657 MB — 1.3% out.

Verification at these commits

BICS 45/45, ODP 24/24 on both backends, [odp_xml] 31 assertions (was 17).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}