state/apiserver: keep backups in env storage

Whenever the backup API is called keep the backup tarball in
environment storage in addition to returning it to the client. Among
other things, this will be used to support rollback when upgrades
fail.
state/apiserver: close backup files once sent to client