Set FD_CLOEXEC in a little convenience function that does the right thing