Stray `<input>.bak` left behind (unnecessary when writing to a separate output file)

[Sdaas]

Problem

create_backup() always copies the input to ${INPUT_FILE}.bak (see decrypt-pdf:243-251). But every decryption strategy writes to a separate OUTPUT_FILE and never modifies the input in place, so this backup serves no purpose. Effects:

• A <input>.bak is created next to the source on every run, cluttering the directory.
• It is only logged under --verbose, so it appears silently by default.
• It is never removed — it persists even after a failed decryption.

Observed while building a bulk wrapper around decrypt-pdf: every attempted/failed file left a stray <input>.pdf.bak that the wrapper had to detect and clean up.

Suggested fix

• Only create a backup when the input is actually about to be modified in place (i.e. when the resolved OUTPUT_FILE == INPUT_FILE).
• Otherwise skip it; or add --backup/--no-backup and remove it on success.
• Either way, document the .bak side effect in the README / --help.