Set CLOEXEC flag on the descriptors The received systemd descriptors don't have `O_CLOEXEC` set because they are received over `exec`. Thus if the process executes a child the child gets polluted with the descriptors. To prevent this, we set `O_CLOEXEC` during initialization. However this also required restructuring of the code because `libsystemd` doesn't provide temporary access to the descriptors - only permanent one. Thus we have to "validate" the descriptors eagerly. We still store the invalid ones as errors to make sure the errors get reported accurately.

--- a/Cargo.toml	Fri Feb 28 13:52:31 2025 +0100
+++ b/Cargo.toml	Fri Feb 28 21:11:19 2025 +0100
@@ -35,3 +35,4 @@
 tokio_0_2 = { package = "tokio", version = "0.2", optional = true, features = ["tcp", "dns"] }
 tokio_0_3 = { package = "tokio", version = "0.3", optional = true, features = ["net"] }
 async-std = { version = "1.7.0", optional = true }
+libc = "0.2.155"