SSS_CERT: Close file descriptors after executing p11_child
    
    We can call cert_to_ssh_key_step from cert_to_ssh_key_done and thus
    p11_child can be executed more time. We created pipes for each call
    but destructor for state->io can close just last one.
    
    It's better to manually close pipes with macro PIPE_FD_CLOSE.
    that macro set file descriptor to -1 and destructor will not try
    to close them 2nd time. Destructor will cover just edge cases.
    
    Merges: https://pagure.io/SSSD/sssd/pull-request/3793
    
    Resolves:
    https://pagure.io/SSSD/sssd/issue/3794
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>