Add --cgroup flag for mounting cgroups

There is already `--tmpfs`, `--dev`, `--proc`, and `--mqueue` for creating mount points for commonly namespaced mount points for sandboxing.

There is also `--unshare-cgroup` which creates the cgroup namespace, but there is no option to mount cgroup controller over the exisiting one.

This is suprising as we must either mount the system one in, including all information from the host, or not have it available in the sandbox at all. Also suprising is that the pids inside the system cgroup do not match the ones inside the pid namespace.

But we could mount the cgroup filesystem inside the sandbox which would make the view of the world consistent. I believe this is impossible with bwrap today.