Ensure that all lock fds are close-on-exec, fixing various problems with them being inherited by child processes such as git commands.

(With the exception of daemon pid locking.)

This fixes at part of #758630. I reproduced the assistant locking eg, a
removable drive's annex journal lock file and forking a long-running
git-cat-file process that inherited that lock.

This did not affect Windows.

Considered doing a portable Utility.LockFile layer, but git-annex uses
posix locks in several special ways that have no direct Windows equivilant,
and it seems like it would mostly be a complication.

This commit was sponsored by Protonet.

Command/PreCommit.hs

@@ -101,6 +101,7 @@ lockPreCommitHook a = do
 #ifndef mingw32_HOST_OS
 	lock lockfile mode = do
 		l <- liftIO $ noUmask mode $ createFile lockfile mode
+		setFdOption l CloseOnExec True
 		liftIO $ waitToSetLock l (WriteLock, AbsoluteSeek, 0, 0)
 		return l
 	unlock = closeFd