Set close-on-exec on all file descriptors we open.

This is useful when we're opening up to fork off child processes,
to avoid various sockets etc. leaking into them (without having to
close all of them explicitly).