cgroup: Add generic cgroup subsystem permission checks