cgroups: support for KernelTcpMemoryLimit= setting

Add a KernelTcpMemoryLimit setting that behaves the same way
as KernelMemoryLimit, except that it controls the
memory.kmem.tcp.limit_in_bytes cgroup attribute.