Turn on close-on-exec flag on file descriptors.

Tup leaves a handful of file descriptors open when forking the rule commands. It would be better if those file descriptors where closed in the child processes, and the child only had open file descriptors 0, 1 and 2 as expected by a UNIX process.

To see the open file descriptors, run the simple rule:

    : |> ls -l /proc/self/fd | tee  %o |> ls_output

On my machine, the output looks like:

```
total 0
lr-x------ 1 gus gus 64 Oct 21 23:14 0 -> /dev/null
l-wx------ 1 gus gus 64 Oct 21 23:14 1 -> pipe:[9611523]
l-wx------ 1 gus gus 64 Oct 21 23:14 2 -> /home/gus/Development/.tup/tmp/output-2719
lr-x------ 1 gus gus 64 Oct 21 23:14 3 -> /home/gus/Development/
lr-x------ 1 gus gus 64 Oct 21 23:14 4 -> anon_inode:inotify
lrwx------ 1 gus gus 64 Oct 21 23:14 5 -> /home/gus/Development/.tup/shared
lrwx------ 1 gus gus 64 Oct 21 23:14 6 -> /home/gus/Development/.tup/object
lrwx------ 1 gus gus 64 Oct 21 23:14 7 -> /home/gus/Development/.tup/tri
lr-x------ 1 gus gus 64 Oct 21 23:14 8 -> /proc/21144/fd
lr-x------ 1 gus gus 64 Oct 21 23:14 9 -> /home/gus/Development/.tup/vardict-build-debug
```

This patch applies the close-on-exec flag to some of the file descriptors. In my (limited) testing, it gets rid of all the extra open file descriptors, except when tup is running as a monitor. In that later case, the vardict file descriptor remains open.