make RestrictSys entries configurable

This PR addresses the TODO from `namespaces/init.go` which was added there by crosbymichael. 
Shouldn't this be `if container.RestrictSys || len(container.RestrictedSysEntries) != 0 {`?