We'll probably want to make this configurable with a
lxc.cgroupns = [1|0], but for now just always do it.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

---
Changelog 20160104: only try to unshare if /proc/self/ns/cgroup exists.