call nsenter with sudo, handle su and sudo

By default, sudo is used for nsenter commands. This behavior could be
disabled in Ansible configuration with:
[nsenter]
sudo = False