machine: enter target PID namespace when adding a live mount

machinectl fails since 21935150a0 as it's now
mounting onto a file descriptor in a target namespace, without joining the
target's PID namespace.
Note that it's not enough to setns CLONE_NEWPID, but a double-fork is required
as well, as implemented by namespace_fork().

Add a test case to TEST-13-NSPAWN to cover this use case.

test/create-busybox-container

@@ -28,6 +28,9 @@ ln -s busybox "$root/bin/cat"
 ln -s busybox "$root/bin/tr"
 ln -s busybox "$root/bin/ps"
 ln -s busybox "$root/bin/ip"
+ln -s busybox "$root/bin/seq"
+ln -s busybox "$root/bin/sleep"
+ln -s busybox "$root/bin/test"
 
 mkdir -p "$root/sbin"
 cat <<'EOF' >"$root/sbin/init"

test/units/testsuite-13.sh

@@ -93,6 +93,29 @@ if echo test >> /run/host/os-release; then exit 1; fi
     fi
 }
 
+function check_machinectl_bind {
+    local _cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; sleep 0.5; done; exit 1;'
+
+    cat <<EOF > /run/systemd/system/nspawn_machinectl_bind.service
+[Service]
+Type=notify
+ExecStart=systemd-nspawn $SUSE_OPTS -D /testsuite-13.nc-container --notify-ready=no /bin/sh -x -e -c "$_cmd"
+EOF
+
+    systemctl start nspawn_machinectl_bind.service
+
+    touch /tmp/marker
+
+    machinectl bind --mkdir testsuite-13.nc-container /tmp/marker
+
+    while systemctl show -P SubState nspawn_machinectl_bind.service | grep -q running
+    do
+        sleep 0.1
+    done
+
+    return $(systemctl show -P ExecMainStatus nspawn_machinectl_bind.service)
+}
+
 function run {
     if [[ "$1" = "yes" && "$is_v2_supported" = "no" ]]; then
         printf "Unified cgroup hierarchy is not supported. Skipping.\n" >&2
@@ -186,4 +209,6 @@ for api_vfs_writable in yes no network; do
     run yes yes $api_vfs_writable
 done
 
+check_machinectl_bind
+
 touch /testok