Set CLOEXEC flag to prevent leaking descriptors

Both the new initctl API and the new pidfile watcher plugin failed to
set CLOEXEC on their sockets.  This caused forked-off and exec()'d
children to inherit all these descriptors.

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

api.c

@@ -346,7 +346,7 @@ int api_init(uev_ctx_t *ctx)
 		.sun_path   = INIT_SOCKET,
 	};
 
-	sd = socket(AF_UNIX, SOCK_STREAM, 0);
+	sd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
 	if (-1 == sd) {
 		_pe("Failed starting external API socket");
 		return 1;