Use REJECT rather than DROP for deny rules

Start of compatibility with security group changes in Warden. Also
start to pull out management of iptables rules in to golang wrappers.

[#82554176]
Disable user namespacing entirely for privileged containers

User namespacing conflicts with nested garden because cgroups are global
and a nested container's root user -- even if mapped to host root --
doesn't get necessary permissions.

[#83806940]
Allow nstar setns to fail

If the container is privileged it won't be running in a user namespace.

[#83806940]
Merge branch 'the-root-of-the-problem-83806940'

[#83806940][#82554176]