cgroups: relax ns_can_attach checks to allow attaching to grandchild cgroups