sandbox: don't call os_close with invalid file descriptor

If open() fails it returns -1. Calling close() with this value
makes no sense. Return -EIO instead.

Addresses-Coverity-ID: 185828 Improper use of negative value
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Fixes: 566bf3a8 ("sandbox: Add a function to read a host file")
Reviewed-by: Sean Anderson <seanga2@gmail.com>