[VladimirMakaev]

fdopendir(3) takes over the descriptor it is given: the caller must not use or close it, and
closedir releases it. Pulse had no model for fdopendir, so the descriptor kept its obligation
and closing the stream never discharged it.

int list_dir(void) {
  int fd = open("mydir", O_RDONLY);
  if (fd < 0) return -1;
  DIR* dir = fdopendir(fd);
  if (!dir) { close(fd); return -1; }
  closedir(dir); // false positive: resource leak on fd
  return 0;
}

Model the ownership transfer: the stream returned by fdopendir owns the descriptor, and a
failure leaves the descriptor with the caller. Leaks of the stream itself, and of a descriptor
left over by a failed fdopendir, are still reported.

Fixes #1419.

Test plan

New fdopendirClosed_ok and three leak controls in c/pulse/fdopendir.c: the stream dropped
without closedir, the descriptor dropped after a failed fdopendir, and a descriptor never
handed over at all. The codetoanalyze tests pass.