runconfig/parse: Properly disallow system root bind mount

Before you could do something like:

    docker run --rm -it -v /./:/host busybox /bin/sh

and get the system root mounted in `/host`. This uses the
`path/filepath.Clean` function to properly check for and prevent other
weird things users could do to try to mess with the host filesystem.