Hide cgroups not under caller's own cgroup

For a directory, we show an empty directory.  For any attempt to getattr
a file, we return -ENOENT.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>