Document running nested in docker/podman

```
# podman run --rm -ti --security-opt seccomp=unconfined quay.io/cgwalters/coreos-assembler bwrap --unshare-pid --unshare-user --bind / / true
bwrap: Failed to mount tmpfs: Permission denied
```

This is actually SELinux. See [this issue](https://github.com/containers/container-selinux/issues/43).

Now, this will work:

```
podman run --rm -ti --security-opt label=type:spc_t --security-opt seccomp=unconfined quay.io/cgwalters/coreos-assembler bwrap --unshare-pid --unshare-user --bind / / true
```

Note if one wants to pass through devices (e.g. `--device /dev/kvm` on the docker/podman side) you'll also want `--dev-bind /dev /dev`.

Now the problem I'm hitting is around `/proc`. Which if one is using `--unshare-pid`, you really need to do, or all of the PIDs are wrong in `/proc` and things will get confused.

Adding `--proc /proc` gets me:
`bwrap: Can't mount proc on /newroot/proc: Operation not permitted`

Which...I'm confused by this right now; why doesn't that work? It looks like our test suite does `--bind /proc proc` but that gets me the same issue with incorrect pids.