Use user namespaces

On new enough kernels, sandbox-supervisor now works without being
setuid root.  I know of two regressions:

 * --proc is broken when user namespaces are used.  Fixing this is possible
   but tricky.

 * Running sandbox-supervisor as root with user namespaces fails.  This
   happens because, once root has entered the namespace, it has insufficient
   privilege to map anyone else into the namespace.  This should be
   straightforward to fix.
When unsharing the user namespace, write the id maps from a helper process

Once we've unshared our user namespace, lose CAP_SETUID relative to
the outside world.  That means that we cannot map anyone except
ourselves into the namepsace, but if we're root, we don't want to
map root in.

By using a helper outside the namespace, the helper retains our
initial privlege level long enough to program the maps.

It would be much simpler to drop root before unsharing, but we would have
to drop it all the way, including clearing the dumpable flag, because
otherwise we would not be permitted to open our own uid_map file.  We
don't want to do that because then we're stuck if we fail to unshare the
namespace.