File descriptor leak on error path in WritePEMToFile (pkg/security/pem.go)

Description:

In pkg/security/pem.go, function WritePEMToFile, a file descriptor opened via:

f, err := os.OpenFile(path, flags, mode)

can be leaked on an error path inside the encoding loop.

Specifically, if pem.Encode fails, the function returns:

return errors.Wrap(err, "could not encode PEM block")

before the file is closed.

Because f.Close() (or a defer f.Close()) is not registered prior to this return path, the descriptor remains open when this error condition is triggered.

This results in a file descriptor leak on that path.

Expected behavior:

The file descriptor should be closed on all return paths.
A minimal fix would be to register defer f.Close() immediately after a successful os.OpenFile, or explicitly call f.Close() before the early return.

Happy to submit a minimal PR if helpful.

Jira issue: CRDB-60702

Epic CC-33751