switch to flat cgroup mount

Mounting each subsystem separately doesn't work if there's an existing cgroup
mounted flat. LXC does this, so for Garden to run in LXC, this change must be
made.

Similarly, mounting a flat cgroup doesn't work if there are existing mount
points for each subsystem. I don't know of anything that mounts each subsystem
separately, but it may make more sense to do "whichever works" in the future.