remount to private subtree after unshare

make sure the whole FS tree is private to the namespace. systemd will
make the default shared on boot, so mount operations would propagate between
the namespace and the system