root: add one-shot open operation

[cyphar]

The resolve -> reopen flow is the most straightforward usage but there is an argument that for users which actually just want to open a file the extra "scratch" file descriptors and syscalls in the openat2 case are less than ideal. For O_PATH, we could adapt the procfs resolver's one-shot implementation but there is very little benefit to doing so (we already have to burn through a lot of syscalls and file descriptors to do O_PATH lookups -- the only reason we have the one-shot implementation for procfs is because we can't use /proc within the procfs resolver) and the added complexity really isn't worth it IMHO.