Update cross-namespace behavior

As per the newly added section to README:

If we are on an older kernel, the only calls we want to reject are
MovePidAbs.  The others will confuse the caller, but not compromise
the host.

On newer kernels we do want to avoid calls which can only confuse
the caller, so require a proxy for those.  There is no good case for
allowing those calls.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>