Use CLOEXEC flag where possible

[DerDakon]

This flag prevents that descriptors are shared beyond an exec*() call. Setting it via fcntl() on pipes or requesting it directly in the wrappers in open.h would remove the burden to close a lot of them. We can not use it unconditionally, as sometimes the descriptors actually should be passed down.