block: Drain io_uring in-flight operations on teardown

Closing an io_uring fd does not synchronously finish requests that
already reached the kernel. During block worker teardown this can let
an io-wq worker keep using retained guest-memory iovecs after reset.

Drain UringDataIo in Drop: retry any published SQEs and wait for CQEs
until no retained operation remains. If draining fails, leak retained
buffers. Drop QcowAsync's ring before its data fd so retrying
published SQEs still uses a valid descriptor.

To avoid a potential infinite loop when completions fail to be delivered
cap the number of iterations of the loop (2x the number of inflight
requests).

Assisted-by: Codex:GPT-5
Signed-off-by: Rob Bradford <rbradford@meta.com>

block/src/formats/qcow/worker/async_uring.rs

@@ -40,6 +40,8 @@ use crate::async_io::{
 /// before the host offset is known.
 pub struct QcowAsync {
     metadata: Arc<QcowMetadata>,
+    // Drop before data_file so pending SQEs can be submitted while fd is valid.
+    data_io: UringDataIo,
     data_file: QcowRawFile,
     backing_file: Option<Arc<dyn BackingRead>>,
     sparse: bool,
@@ -49,7 +51,6 @@ pub struct QcowAsync {
     io_alignment: u64,
     cluster_size: u64,
     decoder: Arc<dyn Decoder>,
-    data_io: UringDataIo,
 }
 
 impl QcowAsync {
@@ -67,12 +68,12 @@ impl QcowAsync {
             cluster_size: metadata.cluster_size(),
             decoder: metadata.decoder(),
             metadata,
+            data_io: UringDataIo::new(ring_depth)?,
             data_file,
             backing_file,
             sparse,
             alignment,
             io_alignment,
-            data_io: UringDataIo::new(ring_depth)?,
         })
     }