Add `--forward-cg-proc` option

Forward /proc/A to /some/path/${cgroup_name}/proc/A

This makes it possible to apply the filter to /proc inside a
different pid namespace, as long as the we can distinguish the
process by cgroup (memory subsys) name and can see the /proc
directory from our mnt namespace.
/proc/self links to the user process pid

- Try our best to translate pid between pidns, it is slow and not
  accurate though
- Hack stat so that cat /proc/xxx won't be empty
- Fix a potential buf overflow in readlink (wrong in fusexmp.c)
Replace readdir with readdir_r

Be safe in a multiple-thread environment.