tree-wide: Add a few missing O_CLOEXEC

I noticed an instance of this while working on https://github.com/ostreedev/ostree/pull/861
Which apparently I cargo-culted into the new system generator bits.
Let's break this out as a small concise change.

Closes: #866
Approved by: jlebon

src/libostree/ostree-fetcher-curl.c

@@ -272,7 +272,7 @@ ensure_tmpfile (FetcherRequest *req, GError **error)
   if (req->out_tmpfile_fd == -1)
     {
       if (!glnx_open_tmpfile_linkable_at (req->fetcher->tmpdir_dfd, ".",
-                                          O_WRONLY, &req->out_tmpfile_fd,
+                                          O_WRONLY | O_CLOEXEC, &req->out_tmpfile_fd,
                                           &req->out_tmpfile,
                                           error))
         return FALSE;