memfd: always create our memfds with CLOEXEC set

We really shouldn't create fds ever that have the flag unset.