Allow specifying whether to unshare cgroup namespaces

<!-- This section is incredibly important for producing high-quality, user-focused documentation such as release notes or a development roadmap. It should be possible to collect this information before implementation begins, in order to avoid requiring implementors to split their attention between writing release notes and implementing the feature itself. KEP editors and SIG Docs should help to ensure that the tone and content of the Summary section is useful for a wide audience. A good summary is probably at least a paragraph in length. --> Allow specifying whether to unshare cgroup namespaces. So far, cgroup namespaces have been unshared only for non-privileged pods on cgroup v2 nodes. See the cgroup namespace paragraph in KEP-2254: Cgroups v2 for the reason: > ### cgroup namespace > > A cgroup namespace restricts the view on the cgroups. When > unshare(CLONE_NEWCGROUP) is done, the current cgroup the process > resides in becomes the root. Other cgroups won't be visible from the > new namespace. It was not enabled by default on a cgroup v1 system as > older kernel lacked support for it. > > Privileged pods will still use the host cgroup namespace so to have > visibility on all the other cgroups.