exec-invoke: save original stdin/stdout with O_CLOEXEC set

We turn off the flag anyway when we install them back as stdin/stdout
later (via dup2()). let's hence follow our usual rules, and turn on
O_CLOEXEC.

src/core/exec-invoke.c

@@ -659,11 +659,11 @@ static int setup_confirm_stdio(
         assert(ret_saved_stdin);
         assert(ret_saved_stdout);
 
-        saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
+        saved_stdin = fcntl(STDIN_FILENO, F_DUPFD_CLOEXEC, 3);
         if (saved_stdin < 0)
                 return -errno;
 
-        saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
+        saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD_CLOEXEC, 3);
         if (saved_stdout < 0)
                 return -errno;