Make it clearer to gcc that open(2) is never called with O_CREAT without mode

We already ensure that this is never done, but `gcc` isn't smart enough to tell that.