open/4,5: make close on exec optional

open(2) on Linux, OpenBSD, FreeBSD and NetBSD support the O_CLOEXEC
flag. Close on exec can be set by the caller.

This change allows passing privileged file descriptors to an unprivileged
process, by:

* opening the fd as root
* dropping privs
* calling exec

fnctl(2) can be introduced later if there are any platforms that do not
support the O_CLOEXEC flag.