cgroup: remove the restriction of subset-of-root-set

At one point in the cgns patchsets I had removed this, but somehow it got
lost in the shuffle. Since we support this now, let's remove this
restriction.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>