libpod: close checkpoint export tar stream

chrootarchive.Tar returns an io.ReadCloser backed by the tar-producing
process.  The checkpoint export path copies from that stream into the
target file, but never closes the reader.

A successful copy reads the stream to EOF, so the producer normally exits.
On early errors, such as failing to create or chmod the target file, or a
copy error, the producer can be left without a consumer.

Close the tar stream after creating it so error paths release the pipe and
allow the producer to exit.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko00@bk.ru>

libpod/container_internal_common.go

@@ -1238,6 +1238,7 @@ func (c *Container) exportCheckpoint(options ContainerCheckpointOptions) error {
 	if err != nil {
 		return fmt.Errorf("reading checkpoint directory %q: %w", c.ID(), err)
 	}
+	defer input.Close()
 
 	outFile, err := os.Create(options.TargetFile)
 	if err != nil {