Besides being more correct, it protects against people accidentally exchanging the permission and open mode arguments to Open. R=rsc CC=golang-dev https://golang.org/cl/1904045
