object-file: fix closing object stream twice

In 10a6762719 (object-file: adapt `stream_object_signature()` to take a stream, 2026-02-23), we have refactored `stream_object_signature()` so that it doesn't create the stream ad-hoc anymore. Instead, callers are expected to pass in a stream, which allows them to construct the streams from different sources. While the stream was previously managed by `stream_object_signature()`, the full lifecycle is now owned by the caller. Hence, it's the caller's responsibility to close the stream, and the called function shouldn't do that anymore. And while the mentioned commit did drop one call that closed the stream, there's a second such call that was missed when reading from the stream fails. The consequence of this can be a double free of the stream. Fix the bug by dropping that leftover call to `odb_read_stream_close()`. Note that it was originally discussed whether this should be treated as a security vulnerability. But there are only two callers: once via `parse_object_with_flags()`, and once via `verify_packfile()`. Neither of these callers plays any role on the transport layer, so this issue is only relevant for objects that are already available via the local object database. Furthermore, a packfile that is corrupted in this way would be detected when receiving the packfile, so it's not easy for an adversary to plant such a packfile, either. Consequently, we decided that this is not covered as part of our threat model. Reported-by: xuqing yang <rigelyoung@icloud.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>