Bug 1040835: factor out exec with a semaphore into execonce

..and refactor firewall::windows_settings to match