erlxc: remove extraneous brackets
erlxc: add support for setting cgroup

The liblxc API for setting cgroups is quirky:

* some items can be set by using set_config_item() by using the lxc
  namespace or by cgroup:

    liblxc:get_config_item(Container, "lxc.cgroup.cpuset.cpus").
    liblxc:get_cgroup_item(Container, "cpuset.cpus").

    liblxc:set_config_item(Container, "lxc.cgroup.cpuset.cpus", "0").
    liblxc:set_cgroup_item(Container, "cpuset.cpus", "0").

* some items can only use *_config_item:

    liblxc:get_config_item(Container, "lxc.cgroup.devices.deny").

* some items can only use *_cgroup_item:

    liblxc:set_cgroup_item(Container, "blkio.weight", "500").
    liblxc:set_group_item(Container, "memory.soft_limit_in_bytes", "268435456").
    liblxc:set_cgroup_item(Container, "memory.limit_in_bytes", "53687091").

The reason for this appears to be:

1. set_config_item/3 is enforced before the container boots

2. get_cgroup_item/2 and set_cgroup_item/3 read/write from the cgroup
directory for the container (usually under /cgroup/lxc/<name>/). These
will fail:

    * if the container is not running
    * the cgroup files do not exist

So these parameters can only be set after booting the container.

3. The cgroup setting "devices.deny" exists but is not
readable/writeable, so has to be set as a configuration value.

Enforcement of cgroups is done after the container is booted. This may
be problematic if, e.g., you want to limit cpu or memory usage the init
script.

cgroup rules are added by by using a tagged tuple to the {config, ...}
property list:

    {config, [
        {cgroup, Key::iolist(), Value::iolist()}
    }]