qemu-char: Use qemu_open() to avoid leaking fds to children