fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks