fix(shared/http): close idle connections to stop updater connection leak (#2648)

Each Download call built a fresh http.Transport whose pool was discarded
on return, so net/http returned the keep-alive connection to a pool that
nothing ever reclaimed. The updater polls the dependencies endpoint every
5 minutes, leaking one idle connection per poll until endpoints accumulated
thousands of ESTABLISHED sockets. DownloadAndVerify doubles the leak
(two downloads per call).

Close idle connections explicitly on return (DisableCompression already set
to match the per-call transport). Same fix as the v11 backport.

Author: yllada

shared/http/download.go

@@ -43,13 +43,16 @@ func Download(url, destDir, filename string, opts DownloadOptions) error {
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: opts.SkipTLSVerify,
 		},
+		DisableCompression: true,
 	}
 
 	client := &http.Client{
 		Timeout:   opts.Timeout,
 		Transport: transport,
 	}
 
+	defer transport.CloseIdleConnections()
+
 	req, err := http.NewRequest(http.MethodGet, url, nil)
 	if err != nil {
 		return fmt.Errorf("error creating request: %w", err)