audit CLOEXEC

[marler8997]

Make sure we're using CLOEXEC when creating file descriptors whenever possible. I noticed we weren't specifying it in the memfd used to load tuple-flatpak-launch into memory, although, in this case we may not be able to use it isince closing it might not allow execveat to work.