feat(compute): Add pg_duckdb extension v0.2.0

[ololobus]

We want to host pg_duckdb on Neon.

Use cases

• faster OLAP queries
• access to datelake files (e.g. parquet) on S3 buckets from Neon PostgreSQL

Because neon does not provide superuser role to neon customers we need to grant some additional permissions to neon_superuser:

GRANT ALL ON FUNCTION duckdb.cache(TEXT, TEXT) TO neon_superuser;
GRANT ALL ON FUNCTION duckdb.install_extension(TEXT) TO neon_superuser;
GRANT ALL ON FUNCTION duckdb.raw_query(TEXT) TO neon_superuser;
GRANT ALL ON FUNCTION duckdb.cache_info() TO neon_superuser;
GRANT ALL ON FUNCTION duckdb.cache_delete(cache_key TEXT) TO neon_superuser;
GRANT ALL ON PROCEDURE duckdb.recycle_ddb() TO neon_superuser;

We also added a patch for issue duckdb/duckdb#15734

The problem is that we do not want to allow the pg_duckdb access to the Neon compute local filesystem, however we still want to allow remote access to parquet files on S3 buckets.

So we want to set duckdb setting disabled_filesystems="LocalFileSystem" and still be able to query S3 buckets.
The patch tries to enable this

We also want to be able to install duckdb supplied core extensions (like iceberg) and needed a further patch to allow extension installation access to the local filesystem, too.

[github-actions]

7403 tests run: 7016 passed, 0 failed, 387 skipped (full report)

---

Flaky tests (5)

Postgres 17

• test_metrics_normal_work: release-x86-64-with-lfc, release-arm64-without-lfc, debug-x86-64-without-lfc
• test_peer_recovery: release-x86-64-without-lfc

Postgres 15

• test_metrics_normal_work: release-x86-64-with-lfc

Code coverage* (full report)

• functions: 33.5% (8500 of 25347 functions)
• lines: 49.3% (71488 of 144978 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
fa2657d at 2025-01-25T18:00:37.190Z :recycle:}

[tristan957]

Approved pending testing on staging.

[ololobus]

I wonder, is it better to keep these grants as a patch for https://github.com/duckdb/pg_duckdb/blob/v0.2.0/sql/pg_duckdb--0.1.0--0.2.0.sql to have everything in one place?

Either way, is there anything else that blocks us from adding this into image? @Bodobolero (thanks for your fixes)

[Bodobolero]

if you set disabled_filesystems=‘LocalFileSystem’ which is necessary to fix the security hole S3 access still doesn’t work.
I will see if I find time today to continue working on the patch.