fix: storage(minio): prevent io.Reader close (#8541)

Fixes #8529, reverts #8527.

I was able to reproduce the problem in a test:
- it triggered only when the reader was an io.Reader
- and the size was provided (-1 takes another code path in minio)

287b1f21e1 should fail when running:
```
docker run --rm -e MINIO_DOMAIN=minio -e MINIO_ROOT_USER=123456 -e MINIO_ROOT_PASSWORD=12345678 -p 9000:9000  data.forgejo.org/oci/bitnami/minio:2024.8.17
```

and

```
TEST_MINIO_ENDPOINT=localhost:9000  go test -v -run ^TestMinioStorageIterator$ ./modules/storage
```

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8541
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>

routers/api/packages/container/container.go

@@ -399,7 +399,12 @@ func EndUploadBlob(ctx *context.Context) {
 		}
 		return
 	}
-	defer uploader.Close()
+	doClose := true
+	defer func() {
+		if doClose {
+			uploader.Close()
+		}
+	}()
 
 	if ctx.Req.Body != nil {
 		if err := uploader.Append(ctx, ctx.Req.Body); err != nil {
@@ -432,10 +437,11 @@ func EndUploadBlob(ctx *context.Context) {
 		return
 	}
 
-	// There was a strange bug: the "Close" fails with error "close .../tmp/package-upload/....: file already closed"
-	// AFAIK there should be no other "Close" call to the uploader between NewBlobUploader and this line.
-	// At least it's safe to call Close twice, so ignore the error.
-	_ = uploader.Close()
+	doClose = false
+	if err := uploader.Close(); err != nil {
+		apiError(ctx, http.StatusInternalServerError, err)
+		return
+	}
 
 	if err := container_service.RemoveBlobUploadByID(ctx, uploader.ID); err != nil {
 		apiError(ctx, http.StatusInternalServerError, err)