Avoid using shell to mount / as private

Instead of shelling out to "mount" and "unshare" we do this by re-execing
outself with the --exec argument, which we catch and apply early in main().

This allows us to use Unshare() and Mount() between the fork in the daemona
and the exec of the lxc-start binary. This is otherwise not possible in
go, at least not while at the same time using the features of the os/exec
module like we do.

This addresses some of the worries of @shykes https://github.com/dotcloud/docker/pull/2157#issuecomment-26176122