[krbdev.mit.edu #6062] better handling of close-on-exec race

[Ken Raeburn via RT]

For most programs, the race condition isn't much of an issue, because we'd have to have a 
multithreaded program (or one doing funny things in signal handlers) that can spawn a user-
controlled or at least user-accessible process at a point where extra file descriptors are open.  
So it needn't be high priority.

The developer systems we're using now aren't new enough to have support for the syscall 
changes, so we can't actually test the use of the new syscalls without building a custom 
configuration.  However, we could certainly build and use the wrapper routines now and update 
them later.