libdocument: Open temp files with O_CLOEXEC
This prevents unwanted leaking file descriptors to child processes.
Note that there are more non-CLOEXEC FDs in evince, e.g. from FDs opened in cairo, poppler, libspectre. I have filed bugs for these with their resp. bug trackers.
There are also 2 instances of g_file_open_tmp() which will be fixed separately.