android_hook: fix leaking file descriptor

/dev/tun is opened but never closed, leaking the file descriptor.
Properly close the file descriptor.

Add O_CLOEXEC. As the FD number is never used, it would be meaningless
to attempt to pass it to a child, as the child would have no way to
figure out what FD was passed from parent to child.

Add O_RDONLY. The original open() call used "0" instead of O_RDONLY.
It's the same thing, but it's more readable to use the macro.

Error check the return value from open(). Otherwise, the remaining code
will attempt to continue and perform an ioctl on an invalid file
descriptor.

Test: none
Change-Id: I5083d175fa9b8e3e8d4707a49f29d0cebe9965f9