make RestrictSys entries configurable

This PR addresses the TODO from `namespaces/init.go` which was added there by crosbymichael. 
@crosbymichael Would you like RestrictSys to only restrict the current default items and make RestrictedSysEntries kick in independently from RestrictSys?