cgroup: Add generic cgroup subsystem permission checks.

    Rather than using explicit euid == 0 checks when trying to move
tasks into a cgroup via CFS, move permission checks into each
specific cgroup subsystem. If a subsystem does not specify a
'can_attach' handler, then we fall back to doing our checks the old way.

    This way non-root processes can add arbitrary processes to
a cgroup if all the registered subsystems on that cgroup agree.

    Also change explicit euid == 0 check to CAP_SYS_ADMIN

Change-Id: Id65d83e286d1a6fe5af1db8ca7c2de0688433356
Signed-off-by: San Mehat <san@google.com>
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>