criu: don't leak a service fd

Recently, I introduced a new mode when a service fd are not dupped into
a fixed file descriptor number. A side effect of this is that we need to
close the old descritpor if it was installed.

Fixes: d3499999 ("criu: remove all magic of service-fd when it isn't required")