Use O_CLOEXEC in util packages

This prevents fd's from leaking to subprocesses.

pkg/util/flock/flock_unix.go

@@ -23,7 +23,7 @@ import "golang.org/x/sys/unix"
 // Acquire acquires a lock on a file for the duration of the process. This method
 // is reentrant.
 func Acquire(path string) error {
-	fd, err := unix.Open(path, unix.O_CREAT|unix.O_RDWR, 0600)
+	fd, err := unix.Open(path, unix.O_CREAT|unix.O_RDWR|unix.O_CLOEXEC, 0600)
 	if err != nil {
 		return err
 	}