Fallback from pidfd_open on permission errors too

Fallback from pidfd_open on permission errors too

Skip using pidfds if we get a permission denied error.
This can happen with an old policy and a new kernel that uses the
new pidfs filesystem to back pidfds, instead of anonymous inodes,
as the existing policy denies access.

This is already the case for most uses of pidfd_open, like pidref,
but not on these two. Fix them.