ksmserver: never allow ICE connections to exhaust RLIMIT_NOFILE

At most use `RLIMIT_NOFILE - 128`; the remainder is reserved for other
uses like invoking the lock screen, other sockets etc.

to implement this there's a trivial ref count on KSMConnection. When too
many references are active we'll force close connections again right
after creation

BUG: 475506