Enter cgroups as part of NsEnter

Since we're exec()ing I think its fine. We'd be having the waitpid() parent waiting for the child in the namespace also in the cgroups which I think is fine, the overhead is to that container anyways.