core: don't migrate PIDs for units that may contain subcgroups, do this only for leaf units

Otherwise a slice or delegation unit might move PIDs around ignoring the
fact that it is attached to a subcgroup.
scope: make attachment of initial PIDs a bit more robust
update TODO
build-sys: turn off SMACK capabilities stuff for now, since it is incompatible with nspawn