labs: fix snapshot taking for ssh installs

autostart_from_config reads the config/scripts.* files from stdin. That
works as long as nothing messes with the standard file descriptors. When
we use ssh to execute scripts within the autostart_from_config reading
loop, stdin is no longer safe.

The result is that config files are only read until the first boot
command is encountered and executed, which for the current configuration
files means that the final snapshot command is skipped.

To fix this bug, the patch opens the config file on file descriptor 3
where it is safe from ssh.

Change-Id: I2880a8b301c6032b1e077bd458b2b25a89552b89