Don't close STDOUT when calling the CA fetch_roots function
    
    cm_subproc_mark_most_cloexec() now closes all open file
    descriptors except for up to three requested for stdin, stdout
    and stderr. Before the optimization those three were always
    left open.
    
    This was causing errors in the IPA helper ipa-server-guard
    because it tries to display the contents of stderr which was
    always being closed, causing ipa-server-guard to blow up.