... except for stdin, stdout and stderr.

Besides the obvious security issue, this avoids an issue where output
processing would hang with more than one pipe vdp:

When we see a VDP_END, we close the external program's stdin. Yet before
we closed all file descriptors, a second external progam would also hold
the stdin pipe's write end open.