make RestrictSys entries configurable

This PR addresses the TODO from `namespaces/init.go` which was added there by crosbymichael. 
RestrictKernelFiles or RestrictKernelInterfaces as kernel access is what we are trying to limit ?