v3.1.1: 3.1.1 Do not leak file descriptors (#35)

The `openpty` function was created on a simpler time, when `O_CLOEXEC`
was not even a thing. Leaking file descriptors was _fine_. But we don't
live in that world anymore.

This change now marks both ends of the PTY as close-on-exec, so that the
file descriptors are not leaked. Importantly, since we rely on both
copies (the one in ruspty and the one in the child) being closed to
consider the stream done, _if_ we manage to leak the FD to another
shell, there will be an unexpected third copy, so the stream will
unnecessarily hang for a second (good that we added a failsafe cap on
execution time)!