policy: close memoized policy filesystems

[crazy-max]

This fixes policy filesystem cleanup so a policy filesystem opened during policy loading is fully closed after use.

Here is a repro with simple test:

func TestPolicyFSHandleLeakRepro(t *testing.T) {
	dir := t.TempDir()

	require.NoError(t, os.WriteFile(
		filepath.Join(dir, "policy.rego"),
		[]byte("package docker\n"),
		0600,
	))

	provider := newPolicyPathFS(context.Background(), nil, policyOpt{
		ContextDir: dir,
	})

	_, ok, err := loadPolicyData(provider, "policy.rego")
	require.NoError(t, err)
	require.True(t, ok)
}

go test -count=1 ./build -run TestPolicyFSHandleLeakRepro
...
TempDir RemoveAll cleanup: unlinkat ...: The process cannot access the file because it is being used by another process.

That happens because loadPolicyData does both Stat and ReadFile, and each call resolves the memoized policy filesystem. The old close path only decremented one reference, so the opened filesystem root stayed alive on Windows.

The policy path filesystem now closes all memoized filesystem references when the wrapper is closed, instead of decrementing only one reference.

Policy loading can resolve the same memoized filesystem more than once while reading a policy file. Closing only one reference can leave the underlying filesystem open, which is especially visible on Windows when temporary policy directories cannot be removed.

[tonistiigi]

I don't get this. The previous function does reference counting. The new one just closes directly, so should be unsafe for multiple users. I also don't see what is left using the previous function.