Low: libcrmservice: don't close descriptors above current limit

This is irrelevant in normal use. However, valgrind can open high-numbered
file descriptors for its own use above the soft limit of the process being run
under valgrind. If that process forks a child that tries to close all open file
descriptors (e.g. the executor running an agent), the close fails because the
file descriptors are invalid, and (ironically) valgrind warns about that.

This allows 5a73027 to work under valgrind. Additionally, we extend the
efficient close method from that commit to pacemakerd's spawning of children.