core: rework cgroup mask propagation

Previously a cgroup setting down tree would result in cgroup membership
additions being propagated up the tree and to the siblings, however a
unit could never lose cgroup memberships again. With this change we'll
make sure that both cgroup additions and removals propagate properly.
nspawn: netns_fd can be removed now
main: don't set no_new_privs when using SystemCallArchitectures= system-wide

After all, we want to allow userspace to get new privs...
unit: slice dependencies should not be subject to DefaultDependencies
core: fix property changes in transient units
core: find the closest parent slice that has a specfic cgroup controller enabled when enabling/disabling cgroup controllers for units
Update TODO