libcontainer: Mount named cgroups in the container

Any "named" cgroups, such as name=systemd that are currently mounted
on the host system are mounted at /sys/fs/cgrop/xyz with the main part
of the mount being read-only, but the part that the container is
inside is made read-write. This means that the container can create
sub-cgroups inside the container and move tasks into int, but never
escape from its current position in those cgroups.

In particular, this allows systemd to mostly work in a non-privileged
container. The only problem currently is that PrivateTmp=true fails
because systemd is not allowed to mount a new /tmp.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)