cgroup: restore devices.deny line by line

The kernel only reads the first line of any write(), so let's write line by
line.

Right now as far as I know devices.deny is the only cgroup property which
must be written line by line. I could move this code to restore_cgroup_prop
if we expect more of these, though.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>