fix: close demand probe response bodies

[houyuwushang]

Description

The on-demand healthcheck path copied an upstream response body to the caller but never closed it. That left response-body resources owned by the transport open after each demand probe and could prevent normal connection cleanup.

This closes a non-nil upstream body after forwarding completes. The regression test uses a tracking ReadCloser to verify both that the body is closed and that its content is still returned to the caller.

Validation:

• go test ./pkg/backends/healthcheck/... ./pkg/proxy/handlers/health/... -count=1
• go test -race ./pkg/backends/healthcheck -run '^(TestDemandProbe|TestDemandProbeClosesUpstreamBody)$' -count=20
• go tool golangci-lint run --timeout 5m ./pkg/backends/healthcheck/...
• go test -run '^$' ./...

Reviewer: @jranson

Type of Change

• Bug fix
• New feature
• Optimization
• Test coverage
• Documentation
• Infrastructure

AI Disclosure

• This contribution DOES NOT include AI-generated changes
• This contribution DOES include AI-generated changes, and I have reviewed the relevant contributing guidelines.

[jranson]

@houyuwushang this is a valid defect, thanks for finding! However, the fix is incomplete. It is possible (and likely) for an error response to include a body, but this fix only closes the body of successful responses since a non-nil err would cause demandProbe to exit prior to the deferred body close. So error response bodies would remain unclosed. A complete fix would be to do this immediately after the t.httpClient.Do call on L317 and before the err nil check on L319:

if resp != nil && resp.Body != nil {
    defer resp.Body.Close()
}

[houyuwushang]

Moved the body close immediately after Do and guarded both resp and resp.Body, so a response returned alongside an error is closed before the error path exits.