ensured
fix foreign cgroups detection in CGRoup.is_foreign()
optimize u_proc_ensure()

The ensure property could be either updated or not. Now you have three
options:

NOUPDATE    - updated only if property not parsed
UPDATE_NOW  - always update
UPDATE_ONCE - update if was not updated since current iteration start

CGROUPS is no more parsed in update_processes_run.