Use O_CLOEXEC at a few places.

Found these FDs unintentionally propagated into forked processes (e.g.
updater) during my local debugging. Use O_CLOEXEC to avoid that.

Test: Dump open FDs in updater process.
Test: Sideload a package on taimen (which uses framebuffer).
Test: Run graphics test on taimen.
Change-Id: I1fb65dd4a103c47d28b15973def9e9359c251ca3

minui/graphics_fbdev.cpp

@@ -56,7 +56,7 @@ void MinuiBackendFbdev::SetDisplayedFramebuffer(size_t n) {
 }
 
 GRSurface* MinuiBackendFbdev::Init() {
-  android::base::unique_fd fd(open("/dev/graphics/fb0", O_RDWR));
+  android::base::unique_fd fd(open("/dev/graphics/fb0", O_RDWR | O_CLOEXEC));
   if (fd == -1) {
     perror("cannot open fb0");
     return nullptr;