Don't use O_NOFOLLOW
Switch to using a before/after lstat()/fstat() check instead of
O_NOFOLLOW to ensure there aren't any shenanigans going on when we go to
tweak permissions on an NSS database's individual files. O_NOFOLLOW
isn't as portable as we'd need.