add initial namespace unshare support for Linux

We'll use this in pkgcore to support FEATURES like network-sandbox or
ipc-sandbox.