migrate to a systemd scope unit

Playpen is now prepared for the single-writer cgroup changes in the
kernel. It has great integration with the systemd tooling, and more
robust error handling. Due to the necessary refactoring, devices can now
be whitelisted for writing and creation rather than just reading.