delegated netns access

While we allow the creation of a new netns, we don't allow configuring it, so our current support is "host network" or "none".

It would be quite interesting to allow root to delegate access to pre-configured network namespaces to bubblewrap users. This could be something like having an extended attribute or ACL on `/proc/$pid/ns/net` ? (If `/proc` supported xattrs which it doesn't). So maybe we define this as having a `/run/bwrap/netns/$netnsname` symlink, and admins which want to grant access to a netns just do:

```
mkdir /run/bwrap/netns/no-vpn
ln -s /proc/$netnspid/ns/net /run/bwrap/netns/no-vpn/net
setfacl -m u:someuser:rx /run/bwrap/netns/no-vpn
```

And then a user could do:

```
bwrap --netns no-vpn
```

And we would try to `readlink` to see whether we could call `setns` ?