core: Add DelegateNamespaces=

This delegates one or more namespaces to the service. Concretely,
this setting influences in which order we unshare namespaces. Delegated
namespaces are unshared *after* the user namespace is unshared. Other
namespaces are unshared *before* the user namespace is unshared.

Fixes #35369

src/core/execute.h

@@ -350,6 +350,7 @@ struct ExecContext {
         unsigned long personality;
 
         unsigned long restrict_namespaces; /* The CLONE_NEWxyz flags permitted to the unit's processes */
+        unsigned long delegate_namespaces; /* The CLONE_NEWxyz flags delegated to the unit's processes */
 
         Set *restrict_filesystems;
         bool restrict_filesystems_allow_list:1;