userns: Add a knob to disable setgroups on a per user namespace basis