Fix file descriptor leaks in remote import, save, and checkpoint operations

[SebTardif]

What does this PR do?

Fixes four file descriptor leaks across remote operations and checkpoint:

1. tunnel/images.go Import: os.Open(opts.Source) opens the import source file but never closes it. Every podman --remote import from a local file leaks one FD. Added defer f.Close().

2. tunnel/images.go Save: For oci-dir/docker-dir formats, a second os.Open(f.Name()) reopens the temp file for untarring but the handle is never closed. Three error paths also leak. Added defer f.Close().

3. bindings/checkpoint.go Restore: os.Open(i) opens the checkpoint import archive, but the result is assigned to an io.Reader variable, hiding the *os.File. No close anywhere. Introduced a typed *os.File variable with defer Close().

4. container_internal_common.go exportCheckpoint: Inside a for loop, os.Create() opens a volume tar file. The explicit close at the end is only reached on the happy path; five error return paths skip it. Added explicit Close() on each error path (not defer, which would accumulate in a loop).

These are the same class of bug fixed in #28723 and #28724.

Bug origins

Finding	Author	Commit	Date
Import FD leak	Brent Baude	0433081	2020-03-31
Save FD leak	Brent Baude	837aad7	2020-03-30
Restore FD leak	Valentin Rothberg	33ec8c6	2021-10-20
Volume export FD leak	Doug Rabson	7518a91	2022-08-27

How was this tested?

All fixes are minimal close/defer additions with no behavioral change. go vet and go build pass on all affected packages. The affected remote packages (tunnel/, bindings/containers/) have no existing test files. Requesting No New Tests label.

Does this PR introduce a user-facing change?

No. The FD leaks are invisible to the user but waste system resources on every affected operation.

NONE