Use O_CLOEXEC at a few places.

Found these FDs unintentionally propagated into forked processes (e.g.
updater) during my local debugging. Use O_CLOEXEC to avoid that.

Test: Dump open FDs in updater process.
Test: Sideload a package on taimen (which uses framebuffer).
Test: Run graphics test on taimen.
Change-Id: I1fb65dd4a103c47d28b15973def9e9359c251ca3