tls: add O_NOFOLLOW to client certificate code
tls: add O_NOFOLLOW to client certificate code

I'm not sure how a symlink might get in here, but if there is one, it's
definitely wrong.  Use O_NOFOLLOW.

Add O_CLOEXEC for good measure.

martinpitt/cockpit,cockpit-project/cockpit,mvollmer/cockpit,mvollmer/cockpit,martinpitt/cockpit,mvollmer/cockpit,martinpitt/cockpit,cockpit-project/cockpit,martinpitt/cockpit,mvollmer/cockpit,mvollmer/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,martinpitt/cockpit