Add validations `user.max_user_namespaces` and `kernel.pid_max` for rootless containers

Rootless containers need to create namespace in user space as the README already mentions. If one of,

• user.max_user_namespaces
• kernel.pid_max

is zero, you end up with the following error:

Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:352: getting the final child's pid from pipe caused: EOF: unknown

The error say that I'm starving for namespaces or PIDs! To make UX better on this,

• we can validate both of variables from sysctl in runtime (ensure not zero)
• better error message: user namespace starvation! consider increase user.max_user_namespaces

For example, https://github.com/docker-library/docker/blob/75036d19c3d68de7d20277d707763f32ddd487aa/dockerd-entrypoint.sh#L171-L178

Test version: v1.0.0-rc93

Ref: https://github.com/moby/moby/issues/40835#issuecomment-730981130

Start with the rootless-container guidance in README and the error path in libcontainer/process_linux.go, then inspect how sysctl values are accessed. Done means zero user.max_user_namespaces or kernel.pid_max values are detected and produce a clear remediation message, with coverage for both cases.