Wrong way to detect network namespace from prestart hook

In case of prestart hook, the network is set relying on /proc/<PID>/ns/net to find the network namespace (https://github.com/docker/libnetwork/blob/master/sandbox_externalkey_unix.go#L54).
But in case the runtime process has switched to the expected network namespace while it has a thread ID different from the process ID, libnetwork will find a wrong/different network namespace.

In order to avoid such issues, it would be good modify https://github.com/docker/libnetwork/blob/master/sandbox_externalkey_unix.go, relying on /proc/<PID>/task/<TID>/ns/net instead.
This asks the question about how to retrieve this thread ID because right now the code relies on https://github.com/opencontainers/runc/blob/master/libcontainer/configs/config.go#L263 which relies on OCI runtime spec here: https://github.com/opencontainers/runtime-spec/blob/master/specs-go/state.go

But I doubt this specs.State structure to be adapted to the purpose of the hook. I mean, I don't think we want to add a new Tid string field to this structure. Instead, we should define HookState with the same fields than specs.State and add this new Tid field.

Start in sandbox_externalkey_unix.go and trace the prestart-hook network namespace lookup, then read the referenced runc config.go and OCI specs.State definitions. Determine how the hook can obtain a thread ID without changing specs.State, and verify that the lookup uses /proc//task//ns/net for the intended namespace.