Fix inject to join network namespace if possible

To correctly run a command in a container with a private network
namespace, inject must join that network namespace. However, it should
also ignore any failure to setns() into the network namespace in case
the container is instead sharing the host network.

In future containers may also support sharing other namespaces with the
host, such as those for IPC, mounts and PIDs. Generate an error if we
fail to join the container user namespace, but subsequently ignore
failures when joining other namespaces, which will happen if they are
shared with the host.
Add some supplementary documentation in TIPS