Add a way to turn off unique_fd's operator int.

unique_fd's implicit conversion to int has led to tons of problems (see
all of the overloads for close, fdopen, fdopendir, etc.). Add a switch
that can turn it off, and reduce the ridiculous amount of work to fix up
callers by introducing a borrowed_fd type that can be constructed from
either int or unique_fd.

Test: treehugger
Change-Id: If77cf5cbcaddacdaec5919a15b3520fb68f51a62