core/namespace: stop applying mount options on private cgroupfs mount

We always unshare cgroup ns for ProtectControlGroups=private/strict,
while the mount options only apply to the cgroupfs instance
in initial cgns (c.f.
https://github.com/torvalds/linux/blob/b69bb476dee99d564d65d418e9a20acca6f32c3f/kernel/cgroup/cgroup.c#L1984)
Hence let's drop the thing wholesale.

Also, as noted in the comment already, mount_private_apivfs()
internally enforces nosuid/noexec, so drop explicit flags too.

src/shared/mount-setup.c

@@ -52,7 +52,7 @@ typedef struct MountPoint {
         MountMode mode;
 } MountPoint;
 
-bool cgroupfs_recursiveprot_supported(void) {
+static bool cgroupfs_recursiveprot_supported(void) {
         int r;
 
         /* Added in kernel 5.7 */