agent: Close fds before spawning agent for security reasons

Don't leak fds into the agent child process after dropping
privileges.

Fixes #506
Closes #567
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>