Previously the code relies on the implicit flush when BufWriter is
dropped. That's not safe.

Per BufWriter's document:

```
It is critical to call flush before BufWriter<W> is dropped. Though
dropping will attempt to flush the contents of the buffer, any errors
that happen in the process of dropping will be ignored. Calling flush
ensures that the buffer is empty and thus dropping will not even attempt
file operations.
```

Signed-off-by: Wei Liu <liuwe@microsoft.com>