fs_mkdirs: use O_NOFOLLOW and O_CLOEXEC

Don't follow symlinks. Suggestion from Jann Horn.

Also, add O_CLOEXEC. This prevents file descriptor leakage should
this code ever run in a multithreaded environment.

I'm not sure if either of these changes actually address any
security concerns, but it's harmless, so go ahead and add it.

Bug: 15675141
Change-Id: I7ba4e9d10439b7150f59759b54e3ad8ccba411e3