[release-branch.go1.12] os: enable the close-on-exec flag for openFdAt

There's a race here with fork/exec, enable the close-on-exec flag
for the new file descriptor.

Updates #33405
Fixes #33424

Change-Id: Ib1e405c3b48b11c867f183fd13eff8b73d95e3b4
Reviewed-on: https://go-review.googlesource.com/c/go/+/188537


Run-TryBot: Baokun Lee <nototon@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
(cherry picked from commit 2d6ee6e8)
Reviewed-on: https://go-review.googlesource.com/c/go/+/188538
Run-TryBot: Ian Lance Taylor <iant@golang.org>