Set CLOEXEC on subprocess pipe endpoints so they are not inherited by the child.

This is what the subprocess module does when it creates pipes, and is
necessary so that a close of the writing side of the stdin pipe will
be recognized by the child process.