Add fdrop()s to the rpctls syscall for the "fp" reference.

Without these fdrop()s, the daemons leaked file descriptors and
it also left closed TCP sockets lying around.
I didn't realize that falloc() returns with two references, one for
the "fd" and one for the "fp".