don't rbind /sys if it's already bind-mounted

If enter-chroot is called twice for the same chroot, we don't want
slave mounts like the systemd cgroup to get blown away.