Do not mount /sys in containers sharing the host network namespace

Linux 3.12 introduced a restriction which prevents new sysfs mounts
unless the caller has CAP_SYS_ADMIN over the current network namespace.
Consequently, contain -n cannot mount /sys in the usual way.

In addition, it is not possible to bind the existing host /sys mount
into a container's root filesystem without doing so recursively. This
would leak any mounts on /sys/fs/cgroup, /sys/fs/debug, etc. into the
container.