Can't use a custom uid/gid in the sandbox together with --dev

First of all: Thanks for your great work!

I'm running a hardened kernel where unprivileged users can't create user namespaces:

```
[root@machine ~]# sysctl kernel.unprivileged_userns_clone
kernel.unprivileged_userns_clone = 0
```

I can run a command as a different user this way:

```
[root@machine ~]# bwrap --bind / / --unshare-all --uid $(id -u http) --gid $(id -g http) true
```

However, that doesn't work with a faked `/dev` any more. (Note that this is just a minimum working example.)

```
[root@machine ~]# bwrap --bind / / --dev /dev --unshare-all --uid $(id -u http) --gid $(id -g http) true
bwrap: unshare user ns: Operation not permitted
```

Note that it works if I omit the `--uid` and `--gid` parameters. Is that behavior intended?

Start by reproducing the two bwrap commands from the issue, comparing the --dev case with the working --uid/--gid invocation. Trace the bwrap entry point and the handling of --dev, --uid, --gid, and user namespaces; done means the intended behavior is established and the failing combination behaves consistently with that decision.

Written by the indexing model from the issue text.