Open iptables-restore pipes with O_CLOEXEC.

This improves security and reliability, and also avoids keeping
superflous fds open in iptables-restore processes: the pipe fds
that are dup2()d are never closed.

Bug: 28362720
Test: bullhead builds, boots
Test: netd_{unit,integration}_test pass

(cherry picked from commit cd0fa850)

Change-Id: I1ec6953327d889eb1948b2a10e532304b308e516