Limit downloader memory retention

[adulau]

Motivation

• Prevent unbounded memory retention by workers that reused a single bytes.Buffer across many advisory downloads, which can keep large backing arrays live for the lifetime of the worker.
• Ensure HTTP response bodies are always closed on non-OK responses to avoid holding network resources and readers open during error paths.

Description

• Removed the long-lived data bytes.Buffer from downloadContext and allocate a per-advisory var data bytes.Buffer inside downloadAdvisory, and updated uses (signature check, forwarding, and file writes) to use the local buffer instead of dc.data.
• Closed response bodies on non-OK responses when loading OpenPGP keys in loadOpenPGPKeys, when fetching changes.csv in loadChanges, and when loading ROLIE feeds in processROLIE to avoid leaking body readers.
• Changes touch cmd/csaf_downloader/downloader.go (main memory/buffer change and small cleanup) and csaf/advisories.go (response-body close fixes and ordering).

Testing

• Ran go test ./cmd/csaf_downloader -run TestShaMarking, which passed.
• Ran go test ./cmd/csaf_downloader ./csaf, where ./csaf package tests passed and cmd/csaf_downloader failed due to an existing TestStoreFailedAdvisory expectation (expected to fail with an error).
• Ran full test suite go test ./..., which showed the same failure only in cmd/csaf_downloader and all other packages passed.

---

Codex Task