Temporary attachment files not closed during XAR import

Steps to reproduce:

Preparation (not necessary to reproduce the bug):

1. Create a page with an attachment that is sufficiently large (at least 1 MB to be sure)
2. Export the page as a XAR archive
3. Go to Content -> Import in the admin area
4. Upload the exported XAR

Reproduction:

1. Run readlink -f /proc/$PID/fd/* 2>/dev/null | grep deleted or another command for getting open files, filtering for deleted files.
2. Import the exported XAR
3. Immediately re-run readlink -f /proc/$PID/fd/* 2>/dev/null | grep deleted or another command for getting open files, filtering for deleted files.

Expected result:

There are no deleted open files reported.

Actual result:

There are deleted open files like attachment14823327115021904565.bin (deleted) inside the Servlet container's temporary directory.

The reason for this is that the output stream to which the attachment is written temporarily is never closed. During garbage collection, those files are eventually closed by the JDK, making it unlikely to have a bigger impact unless you're running huge imports with a lot of attachments on a system without much garbage collection pressure. The code for that was introduced in XWIKI-13950.