avoid overhead of fcntl when setting close-on-exec

unix-2.8.0 adds cloexec to OpenFileFlags, rather than needing to call
setFdOption after opening.

This also might avoid a race, if another thread started a process at
just the wrong time, before the flag got set, it could inherit the FD.

Unfortunately, the arm64-ancient build needs support for older versions
of unix than that, so had to ifdef. That build is still needed to
support using git-annex in termux on phones like mine, I have confirmed
today.

Sponsored-by: Luke T. Shumaker

Utility/LockFile/Posix.hs

@@ -5,6 +5,8 @@
  - License: BSD-2-clause
  -}
 
+{-# LANGUAGE CPP #-}
+
 module Utility.LockFile.Posix (
 	LockHandle,
 	lockShared,
@@ -76,8 +78,13 @@ tryLock lockreq mode lockfile = uninterruptibleMask_ $ do
 openLockFile :: LockRequest -> Maybe ModeSetter -> LockFile -> IO Fd
 openLockFile lockreq filemode lockfile = do
 	l <- applyModeSetter filemode lockfile $ \filemode' ->
-		openFdWithMode (fromOsPath lockfile) openfor filemode' defaultFileFlags
+		openFdWithMode (fromOsPath lockfile) openfor filemode' $
+#if MIN_VERSION_unix(2,8,0)
+			defaultFileFlags { cloexec = True }
+#else
+			defaultFileFlags
 	setFdOption l CloseOnExec True
+#endif
 	return l
   where
 	openfor = case lockreq of