lxc_spawn: don't close pinfd until container is stopped

Otherwise containers may be able to remount -o ro their rootfs
at shutdown.

Reported-by: Harald Dunkel <harri@afaics.de>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>