cgroup: fix --cgroup-root and cgns interaction

Basically, instead of --cgroup-root replacing the actual root, when a cgns
is present, it just replaces the namespace prefix. See patch comments for
details.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>