DRM_CLOEXEC silently dropped when creating prime fds: dma_buf_fd() #if 0's the close-on-exec handling, so the validated flags lie to userspace and dma-buf fds leak across execve

Summary

The ioctl validates and forwards DRM_CLOEXEC, but the shim's dma_buf_fd has the O_CLOEXEC handling compiled out and calls fdalloc with flags=0. Exported PRIME fds stay open across execve - a sandbox/service-downgrade/setuid child silently keeps a handle to another entity's GPU buffer; combined with DF-4429 this widens cross-user GPU buffer access. Set-UF_EXCLOSE fix.