daemon: container: use proper check for symlink

This patch ensures that the mode contains the entire symlink
bitmask, as opposed to having only one portion of it. This is
really a non-issue, since POSIX defines each mode to be a power
of 2, and therefore only one bit needs to be checked. But better
safe than sorry for non-POSIX systems.

Docker-DCO-1.1-Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> (github: cyphar)