Call FileDescription.OnClose() for newfd being replaced in dup2 and dup3.

dup(2) man page specifies:
       If the file descriptor newfd was previously open, it is closed
       before being reused; the close is performed silently (i.e., any
       errors during the close are not reported by dup2()).

Even though we were DecRef-ing and hence releasing the replaced FD, we were
not calling OnClose(). Compare fs/file.c:do_dup2() -> filp_close(tofree), which
in turn calls filp_flush(). In gVisor, FileDescription.OnClose() analogously
does such flush operations.
in turn

PiperOrigin-RevId: 583147682

pkg/sentry/fdimport/fdimport.go

@@ -93,9 +93,14 @@ func Import(ctx context.Context, fdTable *kernel.FDTable, console bool, uid auth
 			hostFD.Release() // FD is transferred to host FD.
 		}
 
-		if err := fdTable.NewFDAt(ctx, int32(appFD), appFile, fdFlags[hostFD]); err != nil {
+		df, err := fdTable.NewFDAt(ctx, int32(appFD), appFile, fdFlags[hostFD])
+		if err != nil {
 			return nil, err
 		}
+		if df != nil {
+			df.DecRef(ctx)
+			return nil, fmt.Errorf("app FD %d displaced while importing FDs", appFD)
+		}
 	}
 	if ttyFile == nil {
 		return nil, nil