libutil/unix: Add O_CLOEXEC to openDirectory

As a precaution. This function might get used for some long persisted
file descriptor and we need good defaults.

src/libutil/unix/file-system.cc

@@ -16,7 +16,7 @@ namespace nix {
 
 Descriptor openDirectory(const std::filesystem::path & path)
 {
-    return open(path.c_str(), O_RDONLY | O_DIRECTORY);
+    return open(path.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC);
 }
 
 void setWriteTime(