Close extraneous file descriptors in containers

Without this patch, containers inherit the open file descriptors of the daemon, so my `exec 42>&2` allows us to `echo >&42 some nasty error with some bad advice` directly into the daemon log. :)

Also, "hack/dind" was already doing this due to issues caused by the inheritance, so I'm removing that hack too since this patch obsoletes it by generalizing it for all containers.

As a last note, this is built on top of half of #5460 to avoid a little merge conflict in hack/make/test-integration-cli.