Support redirect+null descriptors in proc_open

Support redirect+null descriptors in proc_open

This adds support for doing something like:

    [1 => ['pipe', 'w'], 2 => ['redirect', 1]]

This will make descriptor 2 on the child end a dup'd descriptor 1.
This is mainly useful in conjunction with shell-less mode, because
we don't have an easy way to do "2>&1" there.

Additionally we support:

    [1 => ['pipe', 'w'], 2 => ['null']]

Which would be the same as a >/dev/null or >nul redirect, depending
on platform.